SecOps Dashboard

Open the dashboard

Start the manager — it serves the dashboard on the same port — then open it in any browser on your network.

nexus manager run --host 0.0.0.0 --port 8765
nexus manager info        # prints the enrollment key + admin token
# open http://<manager-host>:8765/

Core views

• Overview — live metric cards, the license seat-usage bar, and recent alerts
• Agents — every endpoint; Scan collects telemetry now, Remove frees a seat
• Alerts — rule-engine findings mapped to MITRE ATT&CK; click to ack / resolve, or Secure to remediate
• Events — raw telemetry, filterable by severity
• Incidents — related alerts grouped to kill alert fatigue
• Policy — edit the JSON configuration pushed to all agents
• License — tier, seats, features and expiry at a glance
• Help — a built-in guide so new operators are never lost

SecOps views

Under the sidebar's SecOps group are nine analytics views — the SOC brain layered on the same event/alert store. They all read real data; nothing here is a demo.

Search (SIEM)

A query box using Nexus Query Language (NQL) over events and alerts. Combine field filters with spaces (AND); they all map to the real store.

severity>=high last:24h           # high+critical in the last day
event_type:failed_login           # one field, exact match
event_type:failed_login,sca       # IN (comma = OR)
title:*brute*                     # wildcard contains
target.path:*.env                 # nested JSON path
-origin:demo                      # negation (NOT)
"failed password"                 # free-text phrase

XDR — correlated incidents

Many alerts across time fused into one kill-chain incident (e.g. brute-force → suspicious process → C2 beaconing). Click a row to expand the timeline, the MITRE techniques, and the recommended response.

AI Triage

Local AI cards that prioritise the queue: each shows a priority (P1 / P2 / P3), a score, the false-positive likelihood %, a confidence %, a plain-language kill-chain summary, and recommended actions plus suggested SOAR playbooks. The model learns from which alerts you dismiss — and costs nothing to run.

EDR — process tree

The real parent→child process tree per host (from pid/ppid telemetry). A red nodemarks suspicious lineage — for example a web server spawning a shell (webshell / RCE), Office spawning a script, or an encoded PowerShell command.

UEBA — entity risk

A risk leaderboard of entities scored against their own behavioral baseline — volume spikes, off-hours activity, never-seen activity types, and peer-group outliers — each with the reasons that drove the score.

Threat Intel

The IOC database (IP / domain / URL / hash) plus stats: total IOCs, matches on real telemetry, and a breakdown by type. Import feeds (abuse.ch, MISP, OTX) and matches flow straight into alerts.

Cloud (CSPM)

A cloud posture score plus the CIS-style findings behind it (public storage, open security groups, root without MFA, unencrypted volumes, …) from a config evaluation or a Prowler import.

NDR — network detection

Top external talkers and network-threat stats from connection telemetry — beaconing / C2 (periodic, low-jitter connections), port scans, and connections to known-bad IOC destinations.

SOAR — playbooks

Your automated playbooks (trigger, mode, enabled) and a log of recent runs with their outcome. A playbook reacts to an alert or incident and runs a sequence of steps — notify, block IP, isolate, kill process, and more.

Your first five minutes