Live Threat Intel · A.R.I.A

Security posture

{{ socPostureScore }}/100

Active threats

{{ socThreatsN }}

{{ socCritN }} critical · level ≥ 7

Incidents

{{ socIncN }}

Assets

{{ socAssetsN }}

Threat postureby attack surface

Strong ≥80 Fair 60–79 Weak 40–59 Critical < 40 Coverage gap

How to read: each spoke is an attack surface scored 0–100% posture. A full hexagon is ideal; a spoke pulled toward the center is a weak spot to prioritize. Grey = not yet monitored (coverage gap), not "safe".

MITRE ATT&CK · observed techniques · {{ timeRange }}

Heat = detections fewermore |↗ MITRE ref |cell → drill |◈ < 60 min

↗

Active threats · worst-firstAll alerts →

SeverityThreatAsset / hostWhen

{{ a.asset }} {{ a.when }} ↗

Open cases by statusCases →

{{ o.label }} {{ o.count }} ↗

No open investigations. Threats are detected and auto-contained continuously — an analyst opens a case only when something needs manual review.

Total open cases {{ socOpenTotal }}

Top threats

SOC action center

{{ a.cnt }} {{ a.lab }} ›

Onboard a new client

Stand up a new managed tenant end-to-end — sites, endpoints, dashboards, and client portal — under your umbrella.

Onboard client

Security posture

{{ postureScore }}

/ 100

Needs attention Alerts →

↗

✓ All clear across your umbrella — no clients need attention.

Client threat radar · {{ timeRange }} distance from center = activity volume · color = severity · blips = top clients · dim sector = no source

{{ b.name }}

Open alerts →

Critical High Watch Healthy No source

Identity protection Users & access →

{{ idBlocked }}

{{ idSuccess }}

OTP sign-ins

{{ idFederation }}

Federation / JIT events

Live from the 365SMG OTP sign-in door + AEGIS federation, plus failed and risky Microsoft 365 / Google Workspace sign-ins from the cloud collectors ({{ timeRange }}); automated test logins excluded. Federation / JIT counts provisioning activity (roster sync, intake), not user sign-ins. MFA coverage, risky sign-ins and compromised-credential detection light up once an identity provider (Entra / Google / AEGIS) is connected.

Your clients · worst-first {{ mspClientCount }} managed

Client

Plan

Status

Agents

Alerts

Crit·{{ timeRange }}

Open cases

Actions

{{ c.agents }}

{{ c.alerts }}

{{ c.crit }}

{{ c.openCases }}

SOC view ↗ Reports ↗

No clients under your umbrella yet — click Onboard client above to add your first.

Users & Access

Map each Cloudflare Access login (email) to a role + tenant scope. Who can log in is controlled in the Cloudflare Zero Trust dashboard; this page controls what they can do here. Roles: soc_admin (full + manage users), soc_analyst (respond, cases), read_only (view only).

Users & Access is soc_admin only. Your role: {{ myRole }}.

Full name

Role

Email (their Cloudflare Access login — this is the identity key)

Title / role

Office

Desk phone

Mobile

Tenant scope

All tenants

USERROLECONTACTTENANT SCOPE

{{ u.emailLabel }}

Edit Remove

Agent Installer

Generate a ready-to-run monitoring agent for your endpoints. Each installer is pre-keyed to {{ instTenantName }} and connects out to the 365 Security gateway on port 443 — no inbound firewall changes and no VPN. Run it as Administrator (Windows) or root/sudo (Linux/macOS) on the machine you want monitored.

Endpoint name / hostname

Operating system

Installer ready — {{ instResName }}

Endpoint ID: {{ instResId }}

Agent group: {{ instResGroup }}

Gateway: {{ instResManager }}

Run as: {{ instResRunAs }}

Or run this one-liner on the endpoint

{{ instResCmd }}

{{ tenantCount }} managed client orgs · isolated Grafana + Wazuh

Onboard New Client

{{ g.sub }} · {{ g.countStr }}

Agents

{{ g.agents }}

Alerts 24h

{{ g.alerts }}

Crit

{{ g.crit }}

Cases

{{ g.cases }}

Grafana org {{ t.orgStr }} · {{ t.isoTag }}

Agents

{{ t.agents }}

Sites

{{ t.siteCount }}

WAF 24h

{{ t.waf }}

Attacks

{{ t.attacks }}

Min SSL

{{ t.minSslStr }}

Grafana org {{ t.orgStr }} · {{ t.isoTag }}

Agents

{{ t.agents }}

Sites

{{ t.siteCount }}

WAF 24h

{{ t.waf }}

Attacks

{{ t.attacks }}

Min SSL

{{ t.minSslStr }}

← All tenants

Grafana org {{ tv.org }} · {{ tv.siteCount }} sites monitored

Open org in Grafana ↗

☁️

Email & Cloud telemetry {{ tv.telSummary }}

Client Profile

Organization

Authorization

Primary contact

Primary Report recipient

Escalation path

Sites

Uptime

{{ s.uptimeStr }}

SSL

{{ s.sslStr }}

WAF

{{ s.wafStr }}

Atk

{{ s.attackStr }}

Endpoints

No endpoints with an installed agent for this tenant yet — deploy one from the Endpoint Installer.

DFIR capture {{ e.dfirLabel }}

MALICIOUS {{ e.threat }}

Alerts

{{ e.alertsStr }}

Critical

{{ e.critStr }}

Malicious

{{ e.malStr }}

Last seen

{{ e.lastSeen }}

← {{ sd.tenantName }}

{{ sd.domain }}

{{ sd.tenantName }} · org {{ sd.org }}

Per-site dashboard ↗

{{ s.value }}

{{ sd.panelTitle }} Open in Grafana ↗

Security events by verdict · {{ sd.eventTotal }} in window

No security events for this site in the selected window — quiet is good.

Raw Security Events click a row to investigate

Time

Source

Event

Verdict

Investigate

{{ e.time }}

{{ e.src }}

{{ e.title }}↗

{{ e.meta }}

Scope

Open in Explore ↗

{{ k.value }}

IOC Matches · our assets ↔ known-badrule.groups:misp_ioc_match

Indicator

Type

Seen on · our estate

MISP event

Last seen

Action

{{ m.ioc }}↗

{{ m.type }}

{{ m.lastSeen }}

No IOC matches in window — no asset touched a known-bad indicator. ✓

IOC lookup

Open IRIS alert {{ iocResult.irisId }} ↗

Investigate any IP / domain / hash — threat-intel verdict, attack activity on our estate (events · peak severity · auto-block · IRIS alert), and the suggested action. An IP that attacked us reads SEEN, not CLEAN.

Attacker activity · supporting context

Attack origin map · geolocated source IPs Open in Grafana ↗

No geolocated attacker activity in the selected window — bubbles appear as GeoIP resolves.

Top origin: {{ attackMapTop }}{{ attackNoGeoTxt }} bubble size = hits · colour = containment · live from /api/threat/attackers

Attack flow · source IP → service / port → asset ribbon width = event volume · colour = service/port

External attackers (left) → the port/service they hit (middle) → your affected assets (right) · live from /api/threat/flows

Containment blocked released · 30m timeout detected · not contained LIVE

Global Attacker IPs

Source IP

Country

Activity

Hits

Containment

Action

{{ a.ip }}

{{ a.hits }}

Origin by Country

Top MITRE Techniques

Network IDS · Suricata {{ idsCard.total }}

Top external talkers

Detection queue · Wazuh alerts

Open in Explore ↗ (deep-dive in SIEM)

Client: {{ alertScopeName }}✕ all

Rule{{ aIndRule }}

Level{{ aIndLevel }}

Tenant · agent{{ aIndTenant }}

When{{ aIndWhen }}

Action

{{ a.rule }}↗

rule {{ a.ruleId }} · {{ a.groups }}

L{{ a.level }}

{{ a.tenantName }} · {{ a.agent }}

{{ a.when }}

In IRIS ↗

File-integrity changes · last 24hnewest first · sensitive-path changes in amber

When

Action{{ fimIndAction }}

Path

Tenant · agent

Level{{ fimIndLevel }}

No file-integrity changes match the current filters (last 24h).

{{ f.when }}

{{ f.host }}

L{{ f.level }}

{{ k.value }}

CVE exposure by tenant · click a tenant to drill into endpoints

Tenant

Critical

High

Medium

Low

Total

{{ t.total }}

{{ e.agent }}

{{ e.total }}

Portfolio concentration · tenant → endpoint · tile size = total CVEs, fill = critical density

critical high medium low

{{ t.critStr }} critical

{{ t.total }}

CVE exposure · wazuh-states-vulnerabilitiesCVE dashboard ↗

Package

CVE

CVSS

Fix / remediation

Tenant · agent

{{ v.pkg }}

{{ v.cve }}KEVNVD ↗

{{ v.tenantName }} · {{ v.agent }}

Compliance scorecard · framework pass-rate by tenant click a tenant to scope endpoints + findings · red<50 · amber<80 · green≥80

Tenant

Hosts

Finds

GDPR = process/legal control, not config-scannable (N/A). {{ compMultiNote }}

CIS hardening by endpoint · SCA score vs 70% target Showing: {{ compShowing }}

show all

{{ e.host }} · {{ e.tenant }} · {{ e.os }}{{ e.failStr }}{{ e.scoreStr }}

Compliance findings · what's broken · where · how to fix live Wazuh SCA failed checks

Check (what's broken)

Endpoint (where)

Remediation (how to fix)

Frameworks

Raw

↗

Live from Wazuh SCA (CIS benchmarks, fleet-wide). Framework scores are real pass-rates of checks tagged to each framework; NIST 800-53 uses direct tags where present plus the CIS→NIST crosswalk. GDPR is a process/legal control not covered by config scanning (N/A). Full raw data in the Grafana 365smg-compliance dashboard.

{{ k.value }}

Per-tenant SLA · MTTA / MTTR vs contractual target

Tenant

MTTA

Target

MTTR

Status

{{ r.mtta }}

{{ r.target }}

{{ r.mttr }}

Client-facing PDF reports · white-labeled under 365SMG · availability gated by service plan. Open a report to preview, then print to PDF.

Period June 2026

Client

▼

Template in build

Requires {{ rep.reqPlan }}

Live data: for the 365smg estate, all six reports render live from Wazuh + IRIS — 30-day detections, CVE state, CIS/SCA scores, MITRE breadth, and real IRIS cases. Metrics with no live feed yet (MTTA/MTTR, edge uptime, IdP account/admin-action counts, change-approval records) are shown honestly as “—” rather than estimated — instrumenting those is the remaining roadmap item (see docs/CLIENT_REPORTS.md).

DFIR-IRIS · alerts pushed from the SOC portal → escalate to cases

IRIS alerts ↗ IRIS cases ↗

Ref{{ indRef }}

Status{{ indStatus }}

Title / scope{{ indTitle }}

IRIS object

Opened{{ indWhen }}

Investigate

{{ c.ref }}

{{ c.title }}↗

{{ c.created }}

Report ↗

Tasks ↗

/console reference ↗

{{ k.value }}

Filter

AUTO → PROPOSE = would auto-contain when armed (near-certain + reversible) · PROPOSE = always needs a human (higher FP) · ♻ Reversible = analyst approve is the 2nd eye · ⚠ Irreversible = needs a named 2nd approver

{{ p.actionIcon }} {{ p.actionLabel }} {{ p.confLabel }} {{ p.revLabel }} {{ p.id }} · {{ p.ago }} ago

{{ p.tenantName }} · agent {{ p.agent }} ({{ p.host }}){{ p.targetLine }}

No pending proposals — you're clear. ✓

Currently contained — reverse when triage clears. Each reverse runs through respond() and is audited.

{{ c.tenantName }} · {{ c.detail }}

No active containments. Isolated hosts and quarantined files appear here for one-click reversal.

Automated containment + control-plane actions — the record you can show a client with certainty. Auto-blocked attackers (Wazuh firewall-drop) never create a proposal; they land here as proof they were handled, with a link to the IRIS alert.

Time

Action

Tenant · agent

Requested by

Approved by

Result

Enforce

{{ a.at }}

{{ a.tenantName }} · {{ a.agent }}

{{ a.requester }}

{{ a.approver }}

{{ a.result }}IRIS {{ a.irisId }} ↗

No containment actions in the window. Automated firewall-drop blocks, isolations, quarantines, and approvals appear here — real and persisted, not just this session.

Scope

live · updated {{ siemUpdatedAgo }} · auto-refresh 30s

{{ siemHost }}

Open Grafana Explore ↗

☁️

Microsoft 365 — {{ m365ScopeLabel }} Email & Cloud telemetry (audit log) · read-only

Connected · tenant {{ m365TenantShort }}

Re-verify Microsoft 365 ↗

Connect Microsoft 365 ↗

📧

Google Workspace — {{ gwsScopeLabel }} Email & Cloud telemetry (audit log + alerts) · read-only

Connected · {{ gwsDomain }}

In the client's Google Admin console → Security → Access and data control → API controls → Domain-wide delegation, add Client ID {{ gwsSaClientId }} with these scopes:
{{ gwsScopesText }}
Then enter the client's primary domain and a super-admin email to read as:

{{ h.value }}

Per-client telemetry · {{ telCount }} tenants · click a row for detail

·{{ siemIndStatus }}

Tenant{{ siemIndName }}

Agents{{ siemIndAgents }}

Alerts{{ siemIndAlerts }}

Critical{{ siemIndCrit }}

Freshness{{ siemIndFresh }}

{{ c.agents }}

{{ c.alerts }} {{ c.trendLabel }}

{{ c.critical }}

{{ c.fresh }}

Agents

{{ c.agents }}

Alerts

{{ c.alerts }}

this window

Critical

{{ c.critical }}

L≥12

Top rule{{ c.topRule }}

Ingest freshness{{ c.fresh }}

Open in Grafana ↗

Alerts Cases

Perimeter firewall & IDS · last 24h

Open firewall dashboard ↗

Blocks

Unique blocked src IPs

Top denied port

IDS/IPS alerts

Platform datasources · isolation-enforced shared stack · per-tenant isolation at the datasource

Showing 365 SMG SOC-wide dashboards — pick a tenant in Scope above to see that client's.

Grafana dashboards · {{ launcherCount }} deep-link · Cloudflare Access authenticates you · opens in Grafana ↗

Open ↗

{{ k.value }}

Plan catalog · entitlements

{{ p.label }}{{ p.price }}/mo

{{ p.limitsLine }}

Tenant subscriptions · usage vs. plan · synced from Zoho

Open Zoho Billing ↗

Tenant

Plan

Usage vs. limits

Invoice

MRR

Actions

{{ b.zohoId }}

auto-suspend pending

{{ b.mrr }}

Zoho ↗

Total MRR

{{ totalMrr }}

Zoho is the billing system of record & customer-facing surface (hosted invoices + client portal). This screen is internal control/visibility only — no card data is handled here. Enforcement: UI upsell → orchestrator gate → provisioning limits → auto-suspend on non-payment. See docs/BILLING_ENTITLEMENTS.md.