{% extends "base.html" %} {% block title %}Dashboard · SD RMM{% endblock %} {% block content %}

Security Dashboard

A snapshot of your protection across devices, email and cloud.

{{ kpi.orgs }} organization{{ '' if kpi.orgs==1 else 's' }} · EDR › · Add a device ›
{# ---- Sophos-style alert summary ---- #}
◆ {{ sev_cards.total }}
Total Alerts
 ! {{ sev_cards.high }}
High Alerts
 ▲ {{ sev_cards.medium }}
Medium Alerts
 i {{ sev_cards.low }}
Low Alerts
{# ---- AI briefing (proactive fleet insights) ---- #}

✨ AI briefing — what needs attention

The model reads your fleet’s open detections, vulnerabilities, pending patches and offline hosts, then prioritizes what to act on today. Private on-prem model by default · read-only. Per-detection “Explain with AI” lives on the Threats page.

{# ---- Most recent alerts ---- #}

Most Recent Alerts

View all detections ›   View all alerts ›
{% if recent_alerts %} {% for r in recent_alerts %} {% endfor %}
TimePriorityAlertDevice
{{ r.ts| pt('%b %d, %H:%M') }} {{ {'crit':'High','warn':'Medium','low':'Low','info':'Info'}.get(r.sev, r.sev) }} {{ r.name }} {{ r.host }} Show full details
{% else %}

No open alerts — the fleet is quiet.

{% endif %}
{# ---- Health summary: overall ring + per-check scores ---- #}
{{ health.score }}

Your overall health score

{% if health.crit %}{{ health.crit }} critical item{{ '' if health.crit==1 else 's' }} need{{ 's' if health.crit==1 else '' }} attention{% elif health.n %}{{ health.n }} item{{ '' if health.n==1 else 's' }} need{{ 's' if health.n==1 else '' }} you{% else %}Nothing needs you today{% endif %} · Go to health check ›

{% if health_legend %}

Across {{ health_legend.n }} device{{ '' if health_legend.n==1 else 's' }}. No peer benchmark is shown — we do not have comparable-organisation data to honestly benchmark against.

{% endif %}

Health check scores

{% for c in check_scores %}
{{ c.label }} {{ c.pct }}
{{ c.passed }} of {{ c.n }} devices · weight {{ c.weight }}
{% endfor %}
{% if attention %}

Needs attention

{% for sev, text, href, act in attention %}
{{ text }} {{ act }} ›
{% endfor %}
{% endif %}
{{ kpi.online }}/{{ kpi.total }}
Agents online
{{ kpi.open_det }}
Open detections
{{ kpi.crit }}
Critical (open)
{{ kpi.isolated }}
Isolated hosts
{{ kpi.alerts }}
Active alerts
{{ kpi.total }}
Total assets

Microsoft 365 — Entra ID & Intune

{% if ms_kpi.tenants %}
{{ ms_kpi.total }}
MS devices
{{ ms_kpi.compliant }}
Compliant
{{ ms_kpi.intune }}
Intune managed
{{ ms_kpi.entra }}
Entra devices
{{ ms_kpi.linked }}
Linked to agent
{{ ms_kpi.fleet }}
Unified fleet

{{ ms_kpi.standalone }} agentless (mobile / MDM-only) · Open device view ›

{% else %}

No Microsoft tenant connected. Connect Entra ID & Intune › to pull mobile + MDM-managed devices into the fleet.

{% endif %}

Assets — remote monitoring + EDR

{% if assets %} {% for r in assets %} {% set a = r.agent %} {% for val in [r.cpu, r.ram, r.disk] %} {% endfor %} {% endfor %}
HostOrganizationOSCPUMemoryDiskEDRLast seen
{{ a.hostname }} {% if a.isolated %}isolated{% endif %} {{ r.org_name }} {{ a.os }}{% if a.os_version %} {{ a.os_version }}{% endif %}{% if val is not none %}{{ val }}%{% else %}—{% endif %} {% if r.open_det %}{{ r.open_det }} {% else %}0{% endif %} {% if a.last_seen_at %}{{ a.last_seen_at| pt('%m-%d %H:%M') }}{% else %}never{% endif %}
{% else %}

No assets enrolled yet. Head to Downloads, generate an install token in Admin, and run the one-liner on a device — it installs monitoring, EDR, and remote control in one shot.

{% endif %}

Threat Detection (EDR)

Open EDR console ›
EDR {{ 'ON' if edr_kpi.edr_on else 'OFF' }} IOC match {{ 'ON' if edr_kpi.ioc_on else 'OFF' }} Web filter {{ 'ON' if edr_kpi.webfilter_on else 'OFF' }}
{{ "{:,}".format(edr_kpi.rules) }}
Detection rules
{{ "{:,}".format(edr_kpi.iocs) }}
Threat-intel IOCs
{{ edr_kpi.by_sev.get('crit', 0) }}
Critical (open)
{{ edr_kpi.by_sev.get('warn', 0) }}
Warnings (open)
{{ edr_kpi.feeds_on }}/{{ edr_kpi.feeds_total }}
Feeds active
{% if edr_kpi.recent %} {% for det in edr_kpi.recent %} {% endfor %}
Recent detectionsHostMITRESeverityWhen
{{ det.summary }} {{ det.rule_id[:24] }} {{ det.mitre or '—' }} {{ det.severity }} {{ det.ts| pt('%m-%d %H:%M') }}
{% else %}

No detections yet — the engine ({{ "{:,}".format(edr_kpi.rules) }} rules + {{ "{:,}".format(edr_kpi.iocs) }} IOCs) is armed and watching. Detections appear here the moment a device reports suspicious activity (Windows boxes need Sysmon or 4688 auditing for the richest telemetry).

{% endif %} {% if edr_kpi.top_mitre %}
Top ATT&CK (30d): {% for t in edr_kpi.top_mitre %}{{ t.m }} ×{{ t.c }}{% endfor %}
{% endif %}

Email Security

Open console ›
{% if email_kpi.processed or email_kpi.domains %}
{{ "{:,}".format(email_kpi.processed) }}
Filtered
{{ "{:,}".format(email_kpi.quarantined) }}
Quarantined
{{ email_kpi.domains }}
Domains
{{ email_kpi.scan_threats }}
Mailbox threats
{% if email_kpi.recent %} {% for g in email_kpi.recent %} {% endfor %}
Recent quarantinedFromVerdictWhen
{{ g.subject or '(no subject)' }} {{ g.mail_from }} {{ g.severity }} {{ g.threat_type }} {{ g.ts| pt('%m-%d %H:%M') }}
{% endif %} {% else %}

Email security is built and ready. To protect an organization's mail, onboard their domain in Email › Domains — you give them the DNS records to point their mail through the gateway, and they get full inline filtering, quarantine, DLP and policy control. Try it now via the analyzer test.

{% endif %}
{% endblock %}