SOC Console
The Security Operations Center (SOC) console is your real-time monitoring dashboard for all AI agent activity. It surfaces active sessions, spend tracking, security alerts, and DLP findings in a single view.
Stats bar
The top of the console shows four real-time metrics:
- Active Agents — Number of agent sessions currently running.
- Spend/hr — Aggregated LLM spend across all active agents in the last hour.
- Alerts (24h) — Security alerts raised in the past 24 hours.
- DLP Hits — Content scanning violations detected by CleverGuard.
Live sessions table
The main table shows all active CleverGuard agent sessions with their agent name, model, trust tier, session duration, tool calls made, and current status. Click any row to expand the session detail drawer with the full event timeline.
Security event feed
A live-updating feed of security events including DLP detections, tool drift blocks, rate limit hits, circuit breaker trips, and emergency control activations. Events are color-coded by severity and can be filtered by type.
SOAR panel
The SOAR integrations panel shows connected SIEM/SOAR platforms and their webhook delivery status. Configure new integrations or check delivery health directly from this panel.
Open the SOC Console
Navigate to Security → SOC Console in the dashboard sidebar, or go directly to /dashboard/security/soc.
Review the stats bar
Check the four metrics at the top for a quick health assessment. If Alerts (24h) or DLP Hits are elevated, scroll down to the event feed for details.
Inspect a live session
Click any row in the sessions table to open the session detail drawer. You'll see:
- The agent's guardrail profile and trust tier.
- A timeline of every tool call, content scan, and DLP event.
- Circuit breaker status and remaining budget.
Filter the event feed
Use the filter controls above the security event feed to narrow by event type (DLP, drift, rate limit, emergency), severity level, or time range. This is useful during incident investigation.
Take action from the console
From the session drawer, you can trigger emergency controls: Pause Agent (circuit breaker), Revoke Keys, or Terminate Session. Dashboard-triggered high-impact actions use SignedApproval when approval is required.