Posture
The 24-hour shape of the traffic and what fired in it.
Alert queue
Every detection the engine has raised, newest first. Use ↑↓ or jk to move, Enter to open, a to acknowledge, / to search.
| Sev | Detection | Connection | Proto | ATT&CK | Confidence | Actions |
|---|
Detector catalog
What this engine can detect, and how often each rule has fired.
ATT&CK coverage
Catalogued techniques by tactic, in kill-chain order, shaded by how much has actually been seen. Every mapping carries a written rationale; select a technique to read it.
Protocols
What is on the wire and how much of it the analyzer can parse.
| Protocol | Risk | Encrypted | Packets parsed | Bytes | Alerts |
|---|---|---|---|---|---|
Hosts & flows
Addresses by volume and by threat score, with their active connections.
| Address | Zone | Packets sent | Packets recv | Bytes sent | Alerts | Threat score |
|---|---|---|---|---|---|---|
| Source | Destination | Proto | Pkts | Bytes |
|---|---|---|---|---|
Trends
Alert and traffic volume over the last 24 hours, on one shared time axis.
Engine health
Measured throughput, query latency and database state.
| Detector | Threat type | Packets seen | Findings | Findings per 10k |
|---|---|---|---|---|
Packet log
Decoded frames as the analyzer produced them.
| Time | Source | Destination | Proto | Len | Flags | Decoded L7 |
|---|---|---|---|---|---|---|