Dashboard
The Dashboard is your at-a-glance summary. It aggregates activity, automation executions and containment actions so you can read your posture without digging through individual logs.
In the app: /
KPI Cards
Metric cards summarize the current state: recent CloudTrail activity volume, enabled automation rules, automation runs (executions) in the recent window, and principals currently contained. The numbers refresh each time you load the page.
Activity Over Time
A time series of event/activity volume over a selectable window (7, 14 or 30 days), one point per day in UTC.
Use it to correlate spikes with something concrete — a deployment, a penetration test, a topology change, or a real incident. A spike on a day with no known change is worth opening in the Events explorer.
Recent Executions
The most recent automation runs, newest first: the rule/detection name, severity, status (DETECTED, REMEDIATED or PARTIAL), the principal involved, and resource/action counts. Open a run to see its investigation report.
Recent Actions
The latest entries from the unified Actions log — containment and remediation alike — each with its target, source (rule / manual / rollback) and status. Reversible actions can be rolled back directly from the Actions page.
Active Containments
A count and list of principals currently contained (a containment that has not been rolled back), derived from the action history. Click through to the Actions page, filtered to Active Containments, to release any of them.
ℹ️ Note
Dashboard data is read from DynamoDB and the event snapshots. If it shows zeros but you expect activity, confirm CloudTrail forwarding is reaching the EventsProcessor queue and that inventory collection has run for the accounts you configured.
💡 Tip
Switch to the 30-day window to spot slow trends rather than daily spikes — a gradual rise in a particular actor's activity can indicate low-and-slow reconnaissance.