20. Console basics, the Overview and the wall
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
How the console is laid out, what the banners mean, how four-eyes approval looks from inside a module, and how to read the Overview page and the full-screen wall.
Chapters 21 to 39 describe one console area each. They all use the conventions set out here.
20.1 The layout#
Every page has the same frame:
- Sidebar (left). The modules, in four groups. Type in Filter modules... at the top to narrow the list. A number next to an entry is a count of open work (for example open review-queue items).
- Header (top). The page name and its group, the notification bell, the theme switch and, when encryption is off, a red Unencrypted mark.
- Banners (under the header). Shown only when something needs saying; see 20.3.
- Sign out at the bottom of the sidebar, under your user name and role.
The button with the panel icon in the header (Hide sidebar / Show sidebar) folds the sidebar away. The browser remembers the choice.
Everyday controls#
- Find a module: type in Filter modules... at the top of the sidebar.
- Change the colour theme: in the header's theme switch (Theme) choose Light, Dark or System (follow the computer's setting). The choice is kept in this browser.
- Hide or show the sidebar: press Hide sidebar / Show sidebar.
- Sign out: press Sign out at the bottom of the sidebar. Close the browser on a shared computer as well.
- Encryption warning: on a plain-HTTP server, the x on the red line (Collapse for this session) folds it to the Unencrypted mark; press the mark to show the warning again.
The sidebar groups#
| Group | Entries | Chapter |
|---|---|---|
| Operations | Overview, Environment, Assets, Compliance, Evidence, Hardening, Operations | 20, 10, 38, 22-25, 27, 26, 39 |
| Investigation | Stories, Forensics, Defense, Honeypots, FIM, Logs, Review queue, Playbooks, Approvals | 38, 34, 36, 35, 33, 30-31, 21, 37, 15 |
| Network & Data | Network, Firewall, DLP, AD assessment | 28, 29, 32, 14 |
| Administration | Settings | 39, 15 |
The Operations sidebar entry and the whole Administration group are shown only to administrators.
How console paths are written in this guide#
A path such as Compliance > Schedules > New schedule means: click Compliance in the sidebar, then the Schedules tab at the top of the page, then the New schedule button. The sidebar group is not part of the path.
20.2 Who sees what#
What you can open depends on the permissions of your role (see Overview and concepts and Users, roles and approvals). Each chapter lists the permission each action needs. In short:
- A page you cannot read shows Access denied or a "permission required" panel. Ask an administrator to grant the matching View ... permission.
- A button you may not use is either hidden or refused with a message from the server. Nothing changes on the platform.
- A module your licence does not include shows <module> is not included in this licence. The rest of the platform keeps working. To add a module, speak to whoever manages your licence (see Overview and concepts).
20.3 The banners#
| Banner | Meaning | What to do |
|---|---|---|
| Red line "Encryption is off: passwords, sessions and agent traffic cross the network unencrypted. Turn it on: sudo ./lawliet tls on" | The server runs over plain HTTP. | Turn on HTTPS: TLS and certificates. The x on the line collapses it to the red Unencrypted mark for this session. |
| "Four-eyes is inactive until a second approver exists." | Dual control is on but only one approver exists, so approvers' critical actions run on one signature (each recorded in the audit trail). | Create a second approver: a second Super administrator, or an LSO and an RSO. See Users, roles and approvals. |
| Engagement line "Work window ends ..." or "Close-out: read-only until ..." | The licence is a time-boxed engagement. In close-out the platform is read-only. | Export evidence and reports (chapters 25 and 27), then follow the decommission the agents link. |
| "Sandbox data is active - figures reflect demo topology, not real infrastructure." (Overview only) | Demonstration data is loaded. | Manage sandbox opens Settings > Sandbox (39.9). |
20.4 Four-eyes from inside a module#
Many chapters say "Four-eyes: yes". This is what that looks like on screen. The full model is in Overview and concepts.
You press the button as usual (for example Approve & Execute on a hardening run).
A dialog opens: <action> needs a second signature. Type the reason in Reason. The approver sees your reason and the exact request, nothing else.
Press Send for approval.
What you see: a notice Sent for approval - "<action> has not run yet. It runs once <approver role> signs it off, and you execute it." - with a View request #N link. Nothing has changed on any host or device yet.
An approver opens Approvals > Waiting for me and presses Approve or Reject.
You open Approvals > My requests and press Execute now.
Limits with the default policy: a request expires 60 minutes after it is filed if nobody decides, and an approved request must be executed within 15 minutes of approval. The approval covers exactly the request that was reviewed; if you change anything you must ask again.
If it fails:
- Pressing Cancel in the reason dialog sends nothing. The action is not run.
- "This request is not the one that was approved" - the body or target changed after approval. File a new request.
- The execution window has passed - file the request again.
Which actions are critical, and whether each one needs approval in your deployment, is set in Settings > Access control (chapter 15).
20.5 The notification bell#
The bell in the header shows notifications for your account. A number on it is the unread count.
- Press the bell (Notifications). Needs attention lists items still open; Recent lists the rest.
- Click an item to open what it refers to; it is marked read.
- Press Mark all read to clear the count.
- The gear (Notification settings) opens Settings > Notifications (39.6), where you choose which categories and severities the bell shows and whether critical items pop up.
20.6 The Overview page#
Path: Overview. Permission: View the overview (every built-in role has it).
The page title is Security operations overview. The time stamp under the title says how fresh the figures are; press it to refresh. If a panel could not load, a banner names it and the rest of the page still shows. Could not load dashboard data means the API did not answer at all: see Troubleshooting.
What you see, top to bottom:
| Panel | What it shows | Click-through |
|---|---|---|
| Overall compliance posture | Compliant controls, Violations, Partial, Total assessed, and a ring with the mean score across scans. "No scans completed yet" until the first scan finishes. | Run a scan -> Compliance; View network map -> Network |
| Estate | Agents online, Network nodes, Network zones, Scans (7 days) | Network map |
| Needs a person | Failed controls, DLP incidents, FIM events (24h), Review queue | Review queue |
| Active scans | Scans in progress, or "No scans in progress." | The scan |
| Attention required | Approvals waiting for you, open critical or high review items, the last failed scans, modules reporting a problem. "Nothing needs attention" when all is clear. | Review -> Approvals; Open -> Review queue or the failed scan |
| Review queue | Open, Critical + high, and counts per module | View all |
| Proof of protection | Per host and module, when protection was last shown to work (20.7) | Run drills now |
| Module health | Each module's status and detail | - |
| Domains detected | Active Directory domains seen by agents, with member and DC counts (only when a domain is seen) | AD assessment |
The Integrate button on a detected domain is disabled ("Coming soon (domain integration)"). Use AD assessment instead (chapter 14).
20.7 Proof of protection#
A "drill" proves that a module really works on a host: the agent writes a test log line, a canary file and a canary secret, the platform checks that each was seen by the matching module, and the test items are removed again. The table shows one row per host and one column per module (Agent, Logs, Detections, FIM, DLP, Compliance).
| Status | Meaning |
|---|---|
| Proven | The module showed it works; the time under it is the age of the proof |
| Failed | The drill ran and the module did not see it. Click the cell for the reason |
| Stale | The last proof is too old |
| Running | A drill is in progress (the table refreshes every 15 seconds) |
| Not licensed | The module is not in your licence |
| Not configured | Nothing on this host is set up for that module (for example no FIM policy) |
| Not run | No drill has run yet |
Drills also run by themselves at the interval shown next to the title ("drills every N h").
Procedure: run the drills now#
Permission: Manage agents. Four-eyes: no (a drill changes nothing that stays).
- Open Overview and scroll to Proof of protection.
- Press Run drills now. Drills start on every online host.
- Wait. Cells show Running, then a result.
- Click any cell to read the detail line under the table.
If it fails: the button is disabled with "No online host to drill" when no agent is online. A per-host error is listed above the table. A Failed cell names what was not seen; fix the module on that host (for example add a FIM policy) and run again.
The same table for one host is in Environment > Hosts, in the host's detail panel.
20.8 The wall (full-screen operations view)#
A dark, read-only screen meant for a wall display in the operations room.
- Open Overview and press Wall mode (next to the freshness stamp).
- The wall shows Waiting on a person (approvals with minutes left, then open review items, worst first), Protection, proven per host (up to 10 hosts, worst first, with Last proof), and a footer with hosts online, DLP incidents open, file changes in 24 h and investigations open.
- It refreshes every 30 seconds by itself. The status line top right says Not updating since <time> if refreshes stop, and Cannot reach the server if the first load fails.
- Press Exit wall to return to the Overview.
The wall uses the signed-in session of the browser it runs in. Sign in with an account that has read-only rights (for example a Viewer) on a shared display.
20.9 When a page shows an error#
| What you see | Usual cause | What to do |
|---|---|---|
| A panel says "Could not load ..." and the rest of the page works | One API call failed or timed out | Press the refresh stamp or Retry. If it persists, run ./lawliet doctor (chapter 7) |
| Access denied | Your role lacks the view permission | Ask an administrator |
| "<module> is not included in this licence" | Licence | Speak to whoever manages the licence |
| You are sent to the sign-in page | Session expired | Sign in again |
| A red message after pressing a button | The server refused the action and says why | Read the message; it names the problem |
If you need help, write to [email protected] and attach the diagnostic bundle described in Doctor, diagnostics and support.