Overview is the first page you see in an organisation. It answers one question: what needs you right now? Open it from the sidebar or press g then o.
Needs you
The top of the page shows Needs you, or Nothing needs you right now when everything is clear.
- Approval queue lists plans awaiting your decision, with the number of steps and when each expires. All approvals opens Approvals.
- Priority cases lists open investigations. All investigations opens Investigations.
- If one or more feeds are not healthy, a notice says so and explains that detections depending on them report degraded or unavailable coverage. Review integrations opens Integrations.
Signals
Choose a time range (1h, 6h, 24h, 3d, 7d or 30d; 24 hours by default) and show times in Local or UTC. The Signals section then shows:
- Events timeline: events in the range by dataset, with case starts marked. You need permission to query logs to see it.
- Cases opened, High/critical findings and Ingesting connections. Connections that have not reported are counted separately as not measured, never as healthy.
- Detection coverage: how many detections are Active, Active, with gaps, Needs data, Failing or Disabled. View posture opens Posture.
- Recent verified outcomes of executed plans, once there are any.
Charts can carry a caveat chip such as Incomplete, Sampled or Approximate when the underlying data is not complete.
Before you connect anything
A new organisation shows No telemetry connected yet. Coverage is unknown until a provider is connected. Choose Connect a provider to open the integrations catalogue, or follow Connect your first integration.