Dashboard & Actions
The dashboard answers one question: what needs my attention today? It ranks your fleet by what’s wrong, not alphabetically by hostname.
The header
At a glance you see the number of servers observed, how many are critical, aggregate Health, coverage, pending security updates and servers needing a restart.
Actions
An Action is something Demerzel thinks you should look at — derived from the evidence, ranked by severity, with what to do about it. The kinds you will meet:
| Area | Typical Actions |
|---|---|
| Updates & lifecycle | Security updates waiting; a restart needed to finish updates; a new kernel installed but not running (with the CVEs the reboot would fix, when known); critical or high vulnerabilities with a fix available; an operating system or runtime past its end of life |
| Capacity | A disk nearly full, or filling fast enough to run out soon; sustained memory pressure; a server that looks oversized (cut cost) or undersized (add CPU) |
| Availability | Failed services; an agent that went quiet — with whether the host itself still answers (see Notifications) |
| Exposure | A database or admin service reachable from the internet; SSH exposed with no fail2ban protection; domains served without TLS; a certificate about to expire |
| Web hardening | A site serving a secret file (.env, .git…); phpMyAdmin with no basic auth in front; more PHP workers than the database accepts connections; no slow query log; sites behind Cloudflare that log Cloudflare instead of the visitor; fail2ban guarding SSH only while the web server takes scanner traffic |
| Security incidents | An attack that hurt the service — errors served to real visitors — linked to its incident report |
| Active Defense | The warden frozen by its cap, not running, with a broken policy, or unable to receive the agent’s decisions; a rule demoted after it erred; an address spared because it carries too large a share of your traffic |
Each Action gives you three ways to respond:
| Control | What it does |
|---|---|
| Acknowledge | Records that a human has seen it — it stays visible but marked. |
| Snooze | Hides it for a while (1 hour, 1 day, 1 week), then it comes back if still unresolved. |
| Dismiss | Hides this occurrence until the situation materially worsens. |
Every decision is journaled — see Activity log & audit. Read-only members can view Actions but not act on them.
Recently resolved & recent changes
Below the Actions, the dashboard shows what resolved itself in the last week and a feed of recent attribute changes across your fleet, so you can see movement without digging.