Getting started

Documentation › Getting started

1. Download and verify

1. Get the installer from custosxi.com/download or downloads.custosxi.com only.
2. Download the official installer CustosXI-Setup-{build}.exe from the links above.
3. Before running, compare the file SHA-256 with the published hash when available. See Verify your download.
4. Run the installer as Administrator on Windows 10/11 x64.

2. First-run setup wizard

After installation, CustosXI opens an onboarding wizard. It configures the basics so the Worker service and UI start in a consistent state.

• Protection preset - choose an aggression level (Relaxed to Paranoid). You can change this later in Settings → Signals / Presets.
• Npcap choice - decide whether you want live packet capture now. If you skip Npcap, CustosXI starts in Light protection mode.
• Network adapter - pick the NIC used for monitoring and DNS sinkhole when applicable.
• DNS sinkhole - enable or defer local DNS blocking on the selected adapter.
• Optional add-ons - Suricata, GeoIP, reputation feeds, and similar integrations are optional; install or configure them separately.
• Capture test - in Full mode with Npcap installed, the wizard can verify that live capture starts correctly.

You can open Settings pages from the wizard (for example add-ons) and return without losing progress.

3. Choose your protection mode

Switch modes anytime in Settings → General. Moving from Light to Full restarts capture automatically once Npcap is present. Details: Features: Light vs Full.

4. Learn the dashboard

The dashboard is your home base. What you see depends on the active mode.

Light mode dashboard

• DNS block-rate chart and sinkhole-related KPIs
• Top Risk spotlight and recent timeline events
• LIGHT badge in the footer strip
• No live traffic chart, packet KPIs (Observed / Threats / Unique IPs), or TOP ASN card

Full mode dashboard

• Traffic chart, threat vectors, capture status, and packet-oriented KPIs
• TOP ASN when an ASN database is installed
• Standard enterprise capture layout

Screenshots: home page gallery.

5. Turn on DNS sinkhole (when ready)

DNS sinkhole answers queries for unwanted domains locally so connections never leave your PC. It is central to privacy and bandwidth savings in both Light and Full modes.

1. Open Settings → DNS (or use the dashboard DNS controls after onboarding).
2. Enable sinkhole on the adapter you monitor.
3. Review aggression preset impact on blocking behaviour.
4. Optional: enable aggressive mode to resolve real IPs of sinkholed domains and apply temporary firewall blocks.

If DNS looks wrong after testing, use Emergency recovery to restore default DNS.

6. Explore investigation views

Once comfortable with the dashboard, these areas help you dig deeper:

• Analysis / Top Risk - prioritized entities and scores
• Timeline - chronological security and enforcement events
• Firewall - Windows firewall events in context
• Lists - public blacklists and local block lists
• Log Center - JSONL diagnostics for support (see Logging guide)

In Light mode, packet-only pages show a dimmed overlay with a link to install Npcap instead of appearing broken.

7. Software updates

CustosXI can check downloads.custosxi.com for newer builds.

• Settings → General - enable startup check and update notifications
• Settings → About - installed vs latest version, manual check, download installer
• Title bar shows - update available (1.0.x) when a pending build is known
• Release notes: custosxi.com/releases

8. When something goes wrong

• FAQ - common questions
• Contact - feedback and support (include product version from Settings → About)
• Security issues - security@custosxi.com

Next steps