{{ k.label }}

{{ k.value }}

{{ k.sub }}

Context {{ c.k }} {{ c.v }} FIM 24h {{ fimKpi.value }} · {{ fimKpi.sub }} {{ timeRange }} window

{{ g.name }} org {{ g.org }} {{ g.incidents }} open {{ g.tAlerts }} {{ g.siteCount }} sites

{{ s.domain }}

{{ s.statusLabel }}

{{ s.incidents }}

{{ s.lastDet }}

{{ s.agentsStr }}

{{ p.label }}

{{ s.secondary }}

Users & Access

Map each Cloudflare Access login (email) to a role + tenant scope. Who can log in is controlled in the Cloudflare Zero Trust dashboard; this page controls what they can do here. Roles: soc_admin (full + manage users), soc_analyst (respond, cases), read_only (view only).

Agent Installer

Generate a ready-to-run monitoring agent for your endpoints. Each installer is pre-keyed to {{ instTenantName }} and connects out to the 365 Security gateway on port 443 — no inbound firewall changes and no VPN. Run it as Administrator (Windows) or root/sudo (Linux/macOS) on the machine you want monitored.

Onboard New Client

{{ t.name }}

Grafana org {{ t.orgStr }} · {{ t.isoTag }}

{{ t.healthLabel }}

Agents

{{ t.agents }}

Sites

{{ t.siteCount }}

WAF 24h

{{ t.waf }}

Attacks

{{ t.attacks }}

Min SSL

{{ t.minSslStr }}

Open org in Grafana ↗

{{ tv.isoNote }}

Sites

{{ s.domain }} {{ s.statusLabel }}

{{ p.label }}

Uptime

{{ s.uptimeStr }}

SSL

{{ s.sslStr }}

WAF

{{ s.wafStr }}

Atk

{{ s.attackStr }}

{{ s.label }}

{{ s.value }}

{{ s.sub }}

{{ e.time }}

{{ e.src }}

{{ e.title }}

{{ e.meta }}

{{ e.verdict }}

Explore ↗ + IRIS

Open in Explore ↗

{{ k.label }}

{{ k.value }}

{{ k.sub }}

{{ m.ioc }}

{{ m.type }}

{{ m.seenLabel }}{{ m.seenDir }}

{{ m.seenSub }}

{{ m.event }}

{{ m.lastSeen }}

Explore + IRIS Block

No IOC matches in window — no asset touched a known-bad indicator. ✓

{{ iocResult.verdict }}{{ iocResult.q }}

{{ iocResult.detail }}

Open IRIS alert {{ iocResult.irisId }} ↗

Attacker activity · supporting context

Containment blocked released · 30m timeout detected · not contained LIVE

Open in Explore ↗ (deep-dive in SIEM)

All levelsCritical (L≥12)High (L8–11)Medium (L4–7)Low (<4) {{ alertShowing }}

{{ a.rule }}

rule {{ a.ruleId }} · {{ a.groups }}

L{{ a.level }}

{{ a.tenantName }} · {{ a.agent }}

{{ a.when }}

Explore In IRIS ↗ Escalate ↗

{{ fimToggleLabel }}

No file-integrity changes match the current filters (last 24h).

{{ f.when }}

{{ f.action }}

{{ f.path }}

{{ f.host }}

L{{ f.level }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

{{ t.chevron }}{{ t.tenant }}

{{ t.cCrit.v }}

{{ t.cHigh.v }}

{{ t.cMed.v }}

{{ t.cLow.v }}

{{ t.total }}

{{ e.agent }}

{{ e.cCrit.v }}

{{ e.cHigh.v }}

{{ e.cMed.v }}

{{ e.cLow.v }}

{{ e.total }}

{{ v.pkg }}

{{ v.cve }}KEVNVD ↗

{{ v.cvss }}

{{ v.fix }}

{{ v.tenantName }} · {{ v.agent }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Compliance scorecard · framework pass-rate by tenant click a tenant to scope endpoints + findings · red<50 · amber<80 · green≥80

{{ r.tenantName }}

{{ cell.txt }}

{{ r.endpoints }}

{{ r.findings }}

GDPR = process/legal control, not config-scannable (N/A). {{ compMultiNote }}

CIS hardening by endpoint · SCA score vs 70% target Showing: {{ compShowing }}show all

{{ e.host }} · {{ e.tenant }} · {{ e.os }}{{ e.failStr }}{{ e.scoreStr }}

Compliance findings · what's broken · where · how to fix live Wazuh SCA failed checks

{{ f.title }}

{{ f.host }}

{{ f.remediation }}

{{ f.frameworks }}

↗

Live from Wazuh SCA (CIS benchmarks, fleet-wide). Framework scores are real pass-rates of checks tagged to each framework; NIST 800-53 uses direct tags where present plus the CIS→NIST crosswalk. GDPR is a process/legal control not covered by config scanning (N/A). Full raw data in the Grafana 365smg-compliance dashboard.

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Per-tenant SLA · MTTA / MTTR vs contractual target

{{ r.tenantName }}

{{ r.mtta }}

{{ r.target }}

{{ r.mttr }}

{{ r.statusLabel }}

Client {{ reportSel.plan }} {{ reportSel.availLabel }}

{{ rep.title }} {{ rep.badge }}

{{ rep.cadence }}

Open report Template in build Requires {{ rep.reqPlan }}

Live data: for the 365smg estate, all six reports render live from Wazuh + IRIS — 30-day detections, CVE state, CIS/SCA scores, MITRE breadth, and real IRIS cases. Metrics with no live feed yet (MTTA/MTTR, edge uptime, IdP account/admin-action counts, change-approval records) are shown honestly as “—” rather than estimated — instrumenting those is the remaining roadmap item (see docs/CLIENT_REPORTS.md).

All severitiesCriticalHighMediumLow {{ caseShowing }}

{{ c.ref }}

{{ c.sevLabel }}

{{ c.title }}

{{ c.scope }} · {{ c.created }}

{{ c.objLabel }}

{{ c.objSub }}

Escalate Report ↗ Open ↗ Delete

{{ t.label }} · {{ t.count }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Open Grafana Explore ↗

{{ h.label }}

{{ h.value }}

{{ h.sub }}

Per-client telemetry · {{ telCount }} tenants · click a row for detail

{{ c.name }}

{{ c.agents }}

{{ c.alerts }} {{ c.trendLabel }}

{{ c.critical }}

{{ c.fresh }}

{{ c.chevron }}

Agents

{{ c.agents }}

{{ c.discNote }}

Alerts

{{ c.alerts }}

this window

Critical

{{ c.critical }}

L≥12

Top rule{{ c.topRule }}

Ingest freshness{{ c.fresh }}

Open in Grafana ↗ Alerts Cases

Perimeter firewall & IDS · last 24h Open firewall dashboard ↗

Platform datasources · isolation-enforced shared stack · per-tenant isolation at the datasource

{{ d.name }}

{{ d.healthLabel }}

{{ d.detail }}

{{ d.iso }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Plan catalog · entitlements

{{ p.label }}{{ p.price }}/mo

{{ p.limitsLine }}

{{ ft.sym }}{{ ft.label }}

Open Zoho Billing ↗

{{ b.name }}

{{ b.zohoId }}

{{ b.plan }}

{{ b.addonLine }}

{{ m.label }}{{ m.text }}

{{ b.invLabel }}

auto-suspend pending

{{ b.mrr }}

Manage Suspend Reactivate Zoho ↗

Zoho is the billing system of record & customer-facing surface (hosted invoices + client portal). This screen is internal control/visibility only — no card data is handled here. Enforcement: UI upsell → orchestrator gate → provisioning limits → auto-suspend on non-payment. See docs/BILLING_ENTITLEMENTS.md.