Appearance
Tour of the console
The console (Ageleia) is at https://<your domain>/. Sign in with the account an administrator created for you. The top bar has a Pallas link (opens the AI analyst in a new tab), the theme switch, and your user menu (Change password, Sign out).
Navigation
Pages appear only when your role can view them and the feature is set up on your stack.
| Section | Page | Path | Shown when |
|---|---|---|---|
| Get started | /onboarding | always | |
| Overview | SecOps dashboard | /reports/secops | |
| SOC overview | /soc-overview | ||
| Compliance | /compliance | ||
| Athena Core | /siem/ (opens in a new tab) | ||
| Alerts | Alert triage | /alert-triage | Pallas is enabled |
| All alerts | /detection/events | ||
| Muted rules | /admin/mute-rules | ||
| Network | Threat topology | /detection/network-topology | |
| NIDS | /detection/nids-dashboard | a NIDS sensor is configured | |
| Threat intel | /alerts/threat-intel | ||
| Endpoints | Agents | /agents | |
| Endpoint dashboard | /endpoints | ||
| Vulnerabilities | Vulnerabilities | /detection/vulnerabilities | |
| Investigation | /detection/vulnerability-investigation | ||
| Patching | /detection/patch-management | ||
| Scanner | /admin/network-scanning | scanner module | |
| Response | Policy engine | /response-management/rules | policy_engine module |
| Blocked IPs | /security/blocked-ips | AWS is a perimeter | |
| Active response | /active-response | ||
| Cloud | Firewall, WAF | /security/firewall, /security/waf | AWS is a perimeter |
| AWS | /integrations/aws | AWS telemetry is configured | |
| Office 365 | /integrations/office365 | ||
| Cloudflare | /integrations/cloudflare | Cloudflare is configured | |
| Admin | Users, Roles | /admin/users, /admin/roles | administrators |
| Single sign-on | /admin/sso | administrators | |
| Protected IPs | /admin/protected-ips | administrators | |
| Decoder lab | /admin/decoder-lab | ||
| Platform health | /system-health | ||
| Audit log | /audit | administrators | |
| Integrations | /admin/integrations | administrators | |
| Configuration | /admin/configuration | administrators |
Athena Core, the SIEM dashboard, is at https://<your domain>/siem/.
Roles
Three roles exist from the start. Administrators can create more and set, page by page, who can view and who can edit. See Users and roles.
| Role | Default access |
|---|---|
| Admin | Everything, including users, roles, single sign-on, protected IPs, integrations, configuration and the audit log |
| Security Analyst | Edits alerts, mutes, policy rules, firewall and WAF, blocked IPs, active response, Pallas, Cloudflare, decoder lab and patching. Views the rest, except the admin pages |
| Security Viewer | Views; edits nothing |
Get started
Get started is a checklist that reflects the stack's live state:
- Platform is healthy
- Add your first agent (Enrol endpoints)
- Patch management (optional): turn on Also enable patching when you copy the install command
- Connect cloud and security integrations (optional)
- Invite your team (optional): links to Users
- AI analyst (Pallas) (optional)
- External attack-surface scan (optional)
Below the checklist, Add agents creates install commands for Linux, Windows and macOS, and the command line for the Windows MSI (Windows mass rollout). It also lists Enrolled machines and Install commands issued, where you can revoke tokens.
Platform health
Admin → Platform health shows each part of the stack as Operational, Degraded, Down or Unknown, with a Needs attention list: core services (backend, PostgreSQL, Redis, Keycloak), the detection pipeline (manager and indexer), data freshness of vendor feeds, the response plane (policy evaluator, firewall enforcement, mute sync), scheduled jobs, and integrations (AWS, Cloudflare, Sophos Firewall, SMTP, LLM, Pallas, threat intel, scanner).
An integration you have not set up shows as Not set up, with a link to where it is set up in Admin → Integrations. That is not a fault: it does not make the stack degraded.