Dashboards¶

There are five dashboards, in the Dashboard section of the left rail:


Overview	The page you land on. Everything, across every section.
Assets	Your configuration items — composition, lifecycle, and how complete the records are.
Compliance	Where you stand against each framework, and how the remediation is moving.
PQC	Post-quantum readiness, and exactly what has to be replaced.
Facilities	Rack space, switch interface and address capacity, and the cabling backlog.

Overview is unchanged and remains the default. The other four are not summaries of it — each goes deeper into one question than a shared page has room for.

The rule they all follow: every number links to the list it counted. If a bar says 40, the page it opens shows those 40 and nothing else. Where a number has no such list — a few breakdowns have no equivalent filter — the row is deliberately not clickable rather than dropping you on an unfiltered page.

Overview¶

The page you land on, and it is written for two different readers at once.

Someone running the estate wants to know what is out there, what is waiting for a decision, and what has gone quiet. Someone answering to an auditor wants to know how much of it is on strong cryptography and how good the records are. Both questions are on one page, side by side, because the answers move together — an inventory nobody has curated produces a compliance score nobody should trust.

The top panel¶

Three blocks side by side: Assets Monitored, the site map, and Observed External Connections.

Assets Monitored¶

The big number is every asset under monitoring, whatever it is made of — not only the things that speak TLS — and it opens the whole inventory. Beneath it are nine counts that describe the shape of the estate around it. Every one is a link:

Count	What it counts	Opens
Sites	Sites in the inventory, cloud sites included.	Infrastructure → Sites & locations
AWS regions	AWS regions that have at least one asset, as pinned on the map.	Infrastructure → Sites & locations
Racks	Racks across every site.	Infrastructure → Racks
Prefixes	IP prefixes, the networks the estate sits on.	Infrastructure → Networks
VLANs	VLANs in IPAM.	Infrastructure → VLANs
Cloud accounts	Connected cloud accounts, subscriptions and projects.	The inventory filtered to that class
Clusters	Virtualisation clusters.	Infrastructure → Clusters
Certificates	Certificates discovered across the estate.	Infrastructure → Certificates
To approve	Discovered assets nobody has accepted or denied yet.	Discovery → Approvals, the one place assets are accepted or denied

Each count is the total its list shows, so the number and the page it opens agree. A count that could not be loaded shows a dash and "Couldn't load" under it, never a zero; a zero on screen means the list is genuinely empty.

The site map¶

Sites & locations is a world map with a pin for every site that has a latitude and longitude, and a pin for every cloud region that holds assets. The outline ships with the product, so the map works on an installation with no internet access.

Round pins are sites, placed where the site record says. Diamonds are cloud regions: a cloud site has no position of its own, so each of its locations named for an AWS region (us-east-1, eu-west-2, …) is pinned at that region's datacentre metro. A location whose name is not a known AWS region is not guessed at.
A pin's colour is the worst risk band among its assets: red when it holds any Critical asset, orange when it holds High but no Critical, the accent colour when it holds neither. A Critical pin also carries a halo. Size grows with the number of assets. If the risk counts could not be loaded the pins are drawn in the accent colour rather than being coloured as if everything were clean.
Sites that have no coordinates and no recognisable region are listed in the legend as N unmapped, which opens Infrastructure → Sites & locations, so the map never looks more complete than it is. With no placeable site at all, the map says so and links to the same page.
Drag to pan, use the buttons or hold Ctrl/⌘ and scroll to zoom, and click the globe button, or the sea, to return to the whole world. Labels appear once you zoom in.

Click a pin to zoom to it and open its drill-in beside the map: the number of assets, how many are Critical and High, how many have a certificate expiring within 90 days, and a risk-band bar. A tab list below shows the five riskiest assets (each opens the asset), what's here by class (each opens the inventory filtered to that class at this place), and the site's locations with their asset counts. Open site opens the site page and View assets opens the inventory filtered to this site, or to this region for a cloud-region pin.

Observed External Connections¶

The third-party traffic your sensors have seen, as bars for weak crypto, legacy TLS, expired certificates, reassessment required and PQC-resistant connections, each out of the total. It opens the Connections lens.

Cryptographic posture¶

The second panel. A ring splits your monitored assets into High risk, Medium, Low, Assessed, clean, Not assessed and No crypto observed, with a count beside each; High risk, Not assessed and No crypto observed open the matching assets in the inventory. The number in the middle is the count of open critical findings. Assets with no risk score are grey, never green, so an estate that has never been scanned reads as a grey ring. The unscored assets are split in two. Not assessed is an asset with cryptography on record that has not been scored yet, which is a real gap. No crypto observed is an asset with nothing cryptographic on record (no TLS, SSH, IPsec or other crypto endpoint, no crypto configuration and no at-rest record), such as a device seen only by ARP, so there is nothing to score. In a query they are risk:not_assessed and risk:no_crypto_observed; to match every unscored asset, use risk:not_assessed or risk:no_crypto_observed. Under the ring are the asset count, the number of crypto configurations and the share that are post-quantum, and beside it is the thirty-day individual-risk trend.

Reading "By class"¶

The bars show top-level classes — Hardware, Virtual, Cloud resource, Application, Service, External party, Unknown host — not the specific class of each asset. Those top-level classes divide the estate exactly: every asset is in one and only one, so the bars add up to the total beside them.

Past the fifth, the rest are rolled into a single Other row. Other is a remainder rather than a class, so it is not clickable; expand the inventory's class facet to see what is in it.

Reading "Data quality"¶

The Data quality card, in the row of supporting cards, answers one question: which assets are missing what it takes to act on them? It lists four gaps, each as a bar showing its share of the estate and a count, and each opens exactly those assets in the inventory:

Gap	Meaning
No owner	No owner email and no support group, so nobody to ask when it fails a control.
Unclassified	The classifier could not tell what these are.
No site	Not placed at any site, so there is nowhere to send someone.
Stale	Not seen recently. Still in the inventory, and still counted.

Beneath the gaps is your percentage score on Inventory Hygiene, one of the free compliance frameworks every edition ships. It asks the questions an auditor asks about the records themselves rather than about the cryptography. The gauge shows % and uses Inventory Hygiene's existing green/amber/red feedback; those colours are not individual-risk bands. A score from a framework you have not activated is labelled a preview.

Three numbers sit beside the gauge, and the third is the important one:

passing — checks that had something to look at and were satisfied.
failing — checks with at least one open finding.
not assessed — checks that could not be evaluated at all, because nothing was in scope for them or no rule is configured.

A control nobody could evaluate is not a control that passed. Those are counted separately and are never folded into the score, which is why a small "not assessed" number beside a high score is worth a second look: the score describes the checks that ran.

"Not assessed"¶

If the whole panel reads Not assessed rather than showing a score, one of two things is true and the panel says which:

Inventory Hygiene is not activated. Activate it from Risk & Compliance → Posture. It is free, in every edition, and does not count against any framework limit.
It is activated but has produced no score yet. Evaluation reconciles when assets change; it has not had anything to reconcile yet.

Neither is 100%, and neither is 0. "We have not looked" is a third answer, and this platform reports it as one everywhere rather than rounding it towards reassurance.

The rest of the page¶

Below the top panels:

Needs attention now — a strip of prioritised counts across every section: critical findings, high-risk assets, certificates expiring within thirty days, unscored assets, configurations not yet post-quantum, configurations with no algorithm data at all, and overdue tickets. Each opens the page that answers it. The critical-findings count is across every finding producer (config, drift, EOL, vulnerability, hygiene, crypto and compliance), not just crypto — see Findings → Where to find them for exactly what the tile counts and what its drill-through shows.
The lifecycle, end to end — Discovery → Inventory → Risk & Compliance → Remediation, with a live number at each stage.
Assets by class, Certificate expiry outlook and Data quality — the supporting cards.

"Not PQC-ready" and "Not yet assessed" are two separate tiles on the attention strip, deliberately: a configuration on classical cryptography is a migration target, and a configuration with no algorithm data is a data-quality gap. They are different jobs.

Assets¶

Dashboard → Assets. The estate as configuration items: what you have, who owns it, where it runs, and what you do not know about it.

Configuration items — the total, with its thirty-day movement. A tenant still onboarding sees a large increase and no percentage: a percentage needs a previous count to be a percentage of.
Needs a decision — pending approval, stale, unscored, and assets with no endpoints to probe.
Composition — the estate by class, environment, business unit and ownership.
Lifecycle and provenance — by status, freshness, how each asset was discovered, and risk band.
Record quality — your Inventory Hygiene score, the same one Overview shows.
Attribute coverage — the share of assets carrying each attribute at all. This is the number the breakdowns above cannot tell you: a business-unit chart showing a clean three-way split is far less useful if only a fifth of the estate has a business unit recorded. A low figure here is a data-quality gap, not a risk.

Compliance¶

Dashboard → Compliance. Where you stand, as opposed to what to do about it — that is Posture, which is still where you work a framework control by control.

Overall compliance — the severity-weighted score across your activated frameworks, and how many of the catalogue you have activated.
Posture trend — the same thirty-day risk index Overview shows.
Open findings — active findings and the four severity rungs, across every producer. Each opens the Findings page filtered to that severity.
Frameworks — a card per framework with its score, ranked activated-first and then worst-score-first. A framework you have not activated shows a Preview badge: that score is what you would score, not an obligation you hold. Each card carries the coverage line — "12 of 20 controls assessed" — because 92% over three assessed controls is not a 92% framework.
Top exposures — active findings grouped by the control that failed.
Finding workflow — new, notified, resolved, suppressed and resurfaced. These are shown as separate rows rather than one stacked bar, because they do not divide the findings between them: a resurfaced finding is also counted in its current state.
Remediation — tickets raised, how many are overdue, and the share on track.

PQC¶

Dashboard → PQC. Post-quantum readiness, and the migration worklist.

Classification follows NIST IR 8547, which deprecates classical asymmetric cryptography (RSA, ECDSA, EdDSA, DH, ECDH) after 2030 and disallows it after 2035. Every crypto configuration is classified exactly once into one of four categories, so they add up to your total:


PQC-ready	Uses post-quantum algorithms and no classical asymmetric ones.
Symmetric-safe	Uses no asymmetric cryptography at all, so there is nothing to migrate.
Needs migration	Has at least one classical asymmetric component.
Not yet assessed	Its algorithms did not resolve against the catalogue. An unknown, not a pass.

"Needs migration" and "Not yet assessed" are kept apart throughout. Folding the second into the first would overstate your migration workload by exactly the number of things nobody has looked at yet.

The migration worklist¶

The part of this page you act on: each algorithm family in use that a quantum computer breaks, biggest first, with the catalogue's recommended post-quantum replacement beside it. Where the algorithm catalogue has no recommendation for a family, the row says so rather than suggesting one.

These counts do not add up to your configuration total, and are not meant to. A configuration is counted under every algorithm family it uses, so one TLS configuration appears under its key exchange, its signature algorithm and its cipher at once. The four categories above are the partition; this is a worklist.

Beside it, Already quantum-safe lists the families needing no action. AES appears here, not on the worklist: AES is not a post-quantum algorithm and never will be, but at its key sizes it is quantum-safe, and putting every symmetric cipher you own on a list of things to replace would be wrong.

What if I have no cryptography yet?¶

The gauge reads —, not 0%. Readiness is measured over discovered crypto configurations; nothing discovered means nothing to assess, which is a different statement from "none of your cryptography is safe."

Facilities¶

Dashboard → Facilities. Where there is room, and what is about to run out. It rolls up the utilisation each rack and prefix already carries, so a facilities operator reads one page instead of opening every rack.

Five tiles sit across the top: free rack space (U that is neither used nor reserved, summed over every site), racks over 95%, prefixes over 95%, planned cables over 90 days, and free switch interfaces. "Over" means strictly more than: a rack at exactly 95% is not over 95%.

Below them:

Site capacity — one row per site with racks, free U (with the reserved U shown beside it), how full it is and how many of its racks are over 95%. Click a column heading to sort; click a site to open the Racks list filtered to it. A tenant with a great many sites sees the fullest 200, and the page says so.
Fullest racks — the ten most-used racks, each opening its elevation.
Switches with the fewest free interfaces — the ten switches closest to running out, each opening its Ports tab. An interface counts as free when it is enabled, has no cable and is not marked as connected; virtual and wireless interfaces cannot take a cable and are not counted. Only assets of the Switch class are listed.
Fullest prefixes — the ten fullest, with their VRF (or Global) and size, each opening the prefix's page. The caption also says how many prefixes have no addresses recorded: those read 0%, and that is "nothing recorded", not "known to be empty".
Cables by status and Oldest planned cables — live cables by status, how many LLDP / CDP proposals are waiting for approval, how many planned cables are older than 30 and 90 days, and how many declared cables nothing on the network has ever confirmed. Each opens the Cabling list.

A rack with no devices placed yet counts as empty, and a deprecated rack is not counted as capacity.

You need the dcim.read permission for this one; without it the page says so instead of showing zeros.

When a number cannot be loaded¶

On every dashboard, a tile that could not fetch its number shows a dash and says "Couldn't load", not a zero.

This matters more than it looks. Zero is the most reassuring thing several of these tiles can say — no assets waiting, nothing stale — and a failed request that rendered as zero would be a statement about your estate made on the strength of a request that never answered.

What you need to see it¶

Anyone who can view assets can see the Overview, Assets, Compliance and PQC dashboards. Facilities also needs dcim.read. The individual tiles link to pages with their own permissions — approving an asset needs assets.update, for instance — so a tile may open a page you can read but not act on. See Roles & Permissions.