{% extends "base.html" %} {% block title %}Security · SD RMM{% endblock %} {% block content %} {% include "_security_nav.html" %}

Threats

Fleet EDR · detections, alerts & response across {{ total_agents }} device{{ '' if total_agents==1 else 's' }}

{% if user.is_super_admin %}Controls · Threat intel · Tune rules · {% endif %}updated just now
{{ open_total }}
Open detections
{{ crit_open }}
Critical (open)
{{ det24 }}
Last 24h
{{ isolated }}
Isolated hosts
{{ active_alerts }}
Active alerts
{{ online }}/{{ total_agents }}
Agents online

✨ AI briefing — what needs attention

The model reads the fleet’s open detections, vulnerabilities, pending patches and offline hosts, then prioritizes what to act on today. On-prem by default · read-only.

Detection trend — 30 days

{% for t in trend %}
{% for s in ['crit','warn','low','info'] %}{% if t[s] %}
{% endif %}{% endfor %}
{% if loop.index0 % 5 == 0 %}{{ t.day }}{% endif %}
{% endfor %}
■crit  ■warn  ■low  ■info

Escalations — repeated criticals

{% if escalations %} {% for e in escalations %} {% endfor %}
WhenHostCriticalsTop rules
{{ e.ts| pt('%m/%d %H:%M') }} {% if e.org_id %}{{ e.hostname }}{% else %}{{ e.hostname }}{% endif %} {{ e.crit_count }} in {{ e.window_min }}m ({{ e.rule_count }} rule{{ '' if e.rule_count==1 else 's' }}) {{ e.top_rules or '—' }}
{% else %}

No escalations yet. One fires when a host crosses the critical-detection threshold within the rolling window — tunable per-org in Controls. Each is also pushed to ntfy.

{% endif %}

Open by severity

{% for s in ['crit','warn','low','info'] %}
{{ {'crit':'Critical','warn':'Warning','low':'Low','info':'Info'}[s] }} {{ sev[s] }}
{% endfor %}

ATT&CK heatmap (30d)

{% if mitre %}
{% for m, c in mitre %} {% set it = (c / mitre_max) %}
{{ m }}
{{ c }}
{% endfor %}
{% else %}

No technique-tagged detections yet.

{% endif %}

Most-affected devices (30d)

{% if devices %}
    {% for d in devices %}
  • {% if d.org_id %}{{ d.hostname }}{% else %}{{ d.hostname }}{% endif %} {{ d.count }}
    • {% endfor %}
{% else %}

No detections recorded yet.

{% endif %}

Recent detections

{% if recent %} {% for d in recent %} {% endfor %}
Time (PT)DeviceSevATT&CKDetection
{{ d.ts| pt('%m-%d %H:%M:%S') }} {% if d.org_id %}{{ d.hostname }}{% else %}{{ d.hostname }}{% endif %} {{ d.severity }} {{ d.mitre or '' }} ›{{ d.summary }}
{% else %}

No detections yet. Once a Windows endpoint enrolls with Sysmon, process & network telemetry flows to /v1/events and the 27 built-in + 1042 Sigma rules evaluate it here in real time. Per-device drill-down lives on each device's Security tab.

{% endif %}
{% endblock %}