Fingerprints
—
loading...
Sessions
—
loading...
Stealth Alerts
—
loading...
Confirmed
—
stealth confirmed
Today Alerts
—
last 24h
Queue
—
pending files
DB Size
—
signatures.db
⚑ Incidents
—
❄ Active freezes
—
Recent commands
❤ System Health
—
Services · EC2
Router
Agents · Windows, phones
Notifications · backup · intel
Versions
Queues (backlog)
Disks
Recent alerts · all sources
▣ Stacje — stan zabezpieczeń
—
🛡 IDS — alerty Suricaty
—
◈ Graf połączeń
—
wczytuję…
Kliknij węzeł albo krawędź, żeby zobaczyć szczegóły. Operator: dwuklik albo „pokaż adresy”.
urządzenieoperator (AS)adresdomena (lista / DNS)ryzyko: niskie · średnie · wysokieSTEALTHgrubość krawędzi = liczba sesji · kropki = alert albo wykrycie bez zapisanej sesji w oknie · kreski do ramki operatora = urządzenie bez narysowanej krawędzi do jego pokazanych adresów (np. ruch do niepokazanych)
⇄ Attempts between networks
—
⬤ Active Alerts
📡 Live Events
connecting…
Waiting for events…
◫ Alert Timeline (24h)
All alerts
Confirmed
Suspected
24h view · click bar to filter
◎ Fingerprint Deviation Map
Center: —
Distance from the center = how much a fingerprint differs from it.
⬡ Pipeline Status
◉ Top Fingerprints
TOP
WEAK
RECENT
◧ Queue Status
◎ FP Change History
⟐ Fuzzy Similarity Candidates
🚨 Operational Alerts
Loading...
📋 Known Devices
Loading…
🛡 Known-benign rules (pulse)
A rule says: this LAN device talking to these peers is normal for these alert types. A matching alert stays in the panel with its severity lowered, and pulse asks for no INVESTIGATE or AI analysis. Protected types (reputation, IDS, C2, beacons, …) are never lowered.
Loading...
📈 Host Score Trends
Loading...
🕐 Incident Timeline
Pick a device in the field above, or type an IP and press Enter
⟷ Fingerprint Compare
Pick two fingerprints from the lists (click a field), or type a whole hash
📜 Live Logs
📊 Daily Report
Click GENERATE to create daily report
⏱ Data Freshness
Loading...
📌 BASELINE:
⚡ Anomaly Detection
Loading...
🛡 Agent Evidence
--
Loading evidence…
📦 PCAP Triage
or
Select a PCAP and click ANALYZE
🗑 Retention Policy
Click PREVIEW to see what would be deleted
🔌 API connection
DISCONNECTED
AUTO-REFRESH 30s
Empty address: the address this page came from. TOKEN: the full panel token or the view token (read-only).
⬇ Export
The alerts loaded in the panel: up to the 100 newest from the chosen window (time, IP, protocol, type, score) — the same file as CSV in the Alerts card.
The connection graph, IDS and the IDS rules have CSV buttons of their own in their cards.
◎ Intro
About 3.5 s: two pings, the echo and the logo. A click or any key skips it; a reload of the same tab does not play it again. Kept in this browser.