Command center: every app and agent in one live view
The command center is the first page of Security. It answers one question for the whole organization: is anything wrong right now, and where? Open Monitor → Command center (/command).
It covers every project in the current organization that your role can see, not just the project selected in the header.
Every number leads somewhere:
- Tiles open the list behind the number, in the current project.
- Apps and events open a side panel with the details and what to do next, without leaving the page. From the panel, the app or event opens in its own project and environment.
What it shows
Section titled “What it shows”Health (every plan)
Section titled “Health (every plan)”| Tile | Counts |
|---|---|
| Apps and agents | Apps and agents that reported in the window |
| Open incidents | Incidents not yet resolved |
| Firing alerts | Alerts firing now, with the organization-wide total |
| Apps down | Apps whose uptime monitors are down |
| New issues | New error issues, with how many are open |
Apps and agents
Section titled “Apps and agents”One row per app or agent, with the ones that need attention first:
| Column | Shows |
|---|---|
| Status | Critical when the app is down, has an open incident or has attacks that went through in monitor mode. Warning for firing alerts, new issues, strained infrastructure, any attack, or no protection. |
| Runtime protection | Blocking, Monitoring, Off (switched off or kill switch) or Not reporting (no report from the SDK in the last 24 hours) |
| AI guard | On, Off, or Not reporting (no guard heartbeat in the last 24 hours) |
| Attacks | Runtime attacks blocked and let through |
| Incidents, alerts, uptime, issues | The app’s health |
Use the chips above the grid to show All, Needs attention, Not protected (neither runtime protection nor the AI guard is on) or Under attack.
Select an app to open its panel: its protection and what each status means, its security counts, its most attacked routes, its latest events, its health, and the next step. That might be Open the app, Review in the decision queue, See its vulnerabilities, or How to turn on runtime protection.
Protection comes from the Security module. Without it, or where your role can’t see runtime protection in a project, the protection columns show a dash.
Security (Security module)
Section titled “Security (Security module)”| Tile | Counts |
|---|---|
| Runtime attacks | Runtime protection events, blocked and monitored |
| Guard blocks | Sensitive data blocked by the guard, with redactions and warnings |
| AI security findings | AI app security findings, with how many were stopped |
| Open analyst findings | AI analyst findings still open, critical and warning |
| Not protected | Apps with neither runtime protection nor the AI guard on. Select it to filter the grid to those apps. |
Below the tiles:
- Security events: one feed of runtime protection, guard, AI security and AI analyst events, newest first. Select an event to see what it is and where it happened, then open it, or review a runtime attack in the decision queue. Runtime protection and AI security events open their own page, with the details and a replay of how they happened.
- Threats by OWASP category: the window’s events counted by the OWASP Top 10 for LLM applications (prompt injection, sensitive information disclosure, improper output handling, excessive agency, vector and embedding weaknesses, unbounded consumption) and the OWASP web Top 10 (broken access control, injection, security misconfiguration, vulnerable components, software and data integrity, server-side request forgery), plus your custom rules and decoys. Select a category to open the page where its events are worked.
- Runtime protection: Attacks by type (blocked and monitored) and the Most attacked routes. Monitored attacks wait in the decision queue.
Without the Security module, this part shows what the module adds instead, and the page never asks for security data.
Live connections
Section titled “Live connections”What every instrumented agent talked to in the last 15 minutes: models, tools, databases, hosts, AI services and other agents, with calls, errors and when each was last seen. Open the map goes to Live traffic.
Recent logs
Section titled “Recent logs”The latest log records across your projects, at the severity you filter by. Select a record to open it in its project.
Filters
Section titled “Filters”| Filter | Where it applies |
|---|---|
| Window | Last hour, last 24 hours or last 7 days |
| Project | All projects, or one |
| App or agent | Narrows the tables and feed. Some security totals are not tied to one app, and say so. |
| Severity | All severities, warning and above, or critical only |
Filters reset when you change organization.
Refreshing
Section titled “Refreshing”The page refreshes every 30 seconds while its tab is open, and Refresh updates it at once. If a part does not answer in time, the page keeps the last answer and says which numbers are missing.
Permissions
Section titled “Permissions”- Opening the page needs View the command center.
- Each part shows only what your role may see in each project. A project where your role can’t see a part says so, and the totals leave it out.
- The security part needs the Security module on your plan (hosted) or license (self-hosted).
The server checks all of this. The page only presents it.