SOC operations
Whether the detection pipeline is working, independent of whether it is finding anything. Every panel is driven by a live API response; a panel with no data says so rather than showing a placeholder.
Operations Funnel
Last 24hEvents of Interest
Correlation Instances
Alerts Generated
Signal / Noise
MTTD
Analyst Queue
Connector fleet
Staleness measured against each connector's own poll cadence.
Pipeline Health
Ingest → normalize → fuse → correlate → alert
Ingest
Connector → raw events
Normalize
OCSF mapping
Fuse
Alert fusion
Correlate
Cross-source correlation
Alert
Final alert emission
Rejected events
Last 24 hours, grouped by reason.
Alert posture
Current distribution. A snapshot, not a trend — no endpoint buckets disposition over time.
Detection coverage
Techniques with at least one enabled rule. A disabled rule covers nothing.
Agent throughput and spend
Recorded token usage from the last 7 days of investigation runs.
Actions awaiting approval
Containment the agent has proposed and paused on.
Agreement with analysts
Measured on shadow decisions your analysts have since closed, here or in the source SIEM.
Loading agreement…