CustosXI is a free, local-first network security and monitoring tool for Windows. It provides visibility into network traffic, DNS queries, connections, IP addresses, firewall activity and security signals, with tools to investigate and control unwanted or suspicious network communication.
Choose how deep you want to go on day one. You can switch later in Settings → General.
Light protection is ideal when Npcap is not installed yet. Full protection (Enterprise Capture) unlocks live packet analysis, GEO, Live Traffic, and packet-only settings pages.
| Capability | Light | Full |
|---|---|---|
| Npcap required | No | Yes |
| DNS sinkhole | Yes | Yes |
| Windows Firewall integration | Yes | Yes |
| Aggression presets & signals (DNS-related) | Yes | Yes |
| Top Risk, timeline, blocks, decisions | Yes | Yes |
| Live packet capture | No | Yes |
| Live Traffic & GEO navigation | Hidden | Yes |
| AI / Anomaly, Suricata, TLS fingerprint pages | Overlay (“needs Npcap”) | Yes |
| Dashboard traffic chart & packet KPIs | Hidden | Yes |
| Dashboard DNS block chart & LIGHT badge | Yes | N/A (Full layout) |
| Window title | Light Protection | Enterprise Capture |
If you install Npcap later, switch to Full in Settings. CustosXI restarts capture automatically. Guide: Npcap · Getting started.
Core Windows network security and monitoring capabilities available in Light or Full mode unless noted.
Intercept DNS queries on the monitored adapter and block unwanted domains before they connect. Reduce ads, trackers, and risky destinations. Optional aggressive mode resolves real IPs and applies temporary firewall blocks with escalating duration.
Configurable detection signals score entities over time. Top Risk highlights what matters now; timeline and decision views show why CustosXI alerted or blocked.
Built-in postures from Relaxed (alert-focused) to Paranoid. Tune per-signal block tiers and detection parameters without editing raw config files.
Correlate and manage Windows Firewall rules CustosXI creates. Emergency unblock removes CustosXI block rules when you need a clean network state.
Import and refresh community threat feeds (IPs and CIDR ranges). Matching runs locally - you choose which feeds to enable.
Traffic context, scores, and logs stay on your machine by default. No hidden upload pipeline for everyday telemetry.
Advanced capabilities for deeper network monitoring, traffic analysis and security investigation. Some require Npcap, separate installs, or explicit configuration.
Real-time flows, ports, protocols, and deep packet context. Requires Npcap and Full protection mode.
On-device Isolation Forest and statistical baselines flag unusual volume or behaviour. No cloud LLM. Tune in Settings → AI / Anomaly.
Optional IDS/IPS you install yourself. CustosXI reads eve.json alerts and correlates them in the dashboard. See Suricata guide.
GeoLite2, ASN databases, AbuseIPDB, and other feeds are optional add-ons configured in Settings - not bundled in the installer.
SQLite by default; optional PostgreSQL for larger deployments. Retention and maintenance controls in Settings. Database guide.
Check downloads.custosxi.com for newer builds. Notifications in Settings, About page, and title bar. Release notes on /releases/.
Custos