Full-page capture showing the metric cards, Global Threat Map, and Recent Security Events panel together.

What's on this page

The table with a few rows visible, plus an expanded row showing the command timeline.

Table columns

Filtering and paging

• Risk level filter — narrows the table to one risk tier at a time.
• Row click — expands the row's representative session to show its full command log and any decoy files it touched. If a row's Sessions count is greater than 1, this shows only the most recent occurrence's transcript — the others aren't individually viewable in the table, only reflected in the count.
• Pagination — 10 rows per page; Prev/Next controls appear once there's more than one page's worth.

Export

Export CSV and Export XLSX both download the currently filtered/date-ranged table using the same (IP + Actor + Intent) grouping as the table itself — keeping the most recent matching session as the representative row, with the Sessions column showing the real repeat count. XLSX adds a bold header row and auto-sized columns; CSV stays available for quick imports or scripting. Filenames include the active date range.

The Intent Breakdown metric cards plus the Attacks By Hour and Risk Trend charts.

Time range control

A "From date/hour" → "To date/hour" range picker in the top-right sets the reporting window; click Apply to recalculate every chart and metric against it. The picker won't let you select an inverted range (the calendar and hour dropdowns constrain each other automatically).

Charts & panels

Export

Export Full Report (CSV) downloads a ZIP file containing one clean, flat CSV per panel above (e.g. Attacks_by_Hour_of_Day.csv, Protocol_Breakdown.csv) — no combined multi-table file to parse apart. Export Full Report (XLSX) downloads a single workbook with the same data, one sheet per panel, bold header rows, and auto-sized columns. Both filenames include the active date range.

The issues table with a row expanded to show Evidence / Recommended Fix / Impact.

Table columns

Row detail

Click a row to expand it: Evidence (why the classifier flagged this), Recommended Fix, and Impact — all pulled from the same built-in playbook as the title.

Paging

10 issues per page, same Prev/Next pattern as Sessions. The page auto-refreshes roughly every 30 seconds, but pauses while you have a row expanded so it doesn't collapse mid-read.

The persona table on the Configuration tab.

Two tabs, same pattern used on the Alerts page's Email/Slack toggle.

Configuration tab

A table of every persona — presets and any customized ones — with hostname, open ports, and a Customize / Edit Config action. + Create New Persona starts a brand-new one from a slug ID instead of overriding a preset.

Persona modal — Identity section

Display Name, Hostname, OS Banner, SSH Banner, and Internal Notes fields.

Persona modal — Deception section

Fake Users, Running Processes, HTTP Server Type, and Decoy Files fields.

Persona modal — Alerting section

Alert Routing, Min Risk Level, Recipient Email, and Slack Webhook fields.

Analytics tab

The persona dropdown plus the scoped cards, trend chart, and ranked-bar panels below.

Pick a persona from the dropdown to see stats scoped to that persona only:

The Email tab's SMTP configuration form, plus the Alert History table below it. Use a demo SMTP account/From Email here, not a real personal inbox.

Email tab — SMTP configuration

Send Test Email fires a real send using the currently saved configuration (requires Enable email alerts to be on, plus SMTP Host and From Email set) — a quick way to verify credentials before relying on them. Its result message appears next to the button itself, separate from Save Configuration's own status message.

Slack tab

The webhook URL field and Send Test Message button.

Slack routing is per-persona (see Personas → Alerting section), not global — this tab exists purely to test a webhook URL before you paste it into a persona's config. Paste the webhook, click Send Test Message, and check the channel. Only https://hooks.slack.com/… URLs are accepted.

Alert History

The metric cards and the delivered/failed alert table below them. Set the persona's Recipient Email to a demo address (e.g. demo@example.com) before generating these alerts — the Recipient column will show whatever real address was configured at send time.

Metric cards above the table summarize Total Alerts, Last 24h, Delivered, and Failed counts. 10 rows per page.

Why an alert might not fire

1. Global Enable email alerts is off (email only — Slack has no separate global switch).
2. The persona's Alert Routing is none, or doesn't include the channel you expected.
3. The session's risk level doesn't meet the effective threshold (persona override, or the global default if none is set).
4. The destination field (Recipient Email / Slack Webhook) is empty for the channel that's supposed to fire.

• brute_force_bot — a completed username+password submission, or repeated connections from the same source IP. This is the most common label; the honeypot has no way to distinguish your own manual testing from a real attacker.
• script_kiddie — recognizable off-the-shelf tool names typed at the shell.
• skilled_human_operator — timing and command patterns consistent with a real person working interactively, not a script.
• Others are added via classifier/rules/default_rules.yaml — new patterns don't require touching scoring code.