{{ k.label }}

{{ k.value }}

{{ k.sub }}

Context {{ c.k }} {{ c.v }} {{ timeRange }} window

{{ g.name }} org {{ g.org }} {{ g.incidents }} open {{ g.siteCount }} sites

{{ s.domain }}

{{ s.statusLabel }}

{{ s.incidents }}

{{ s.lastDet }}

{{ s.agentsStr }}

{{ p.label }}

{{ s.secondary }}

Onboard New Client

{{ t.name }}

Grafana org {{ t.org }} · {{ t.isoTag }}

{{ t.healthLabel }}

Sites

{{ t.siteCount }}

WAF 24h

{{ t.waf }}

Attacks

{{ t.attacks }}

Min SSL

{{ t.minSsl }}d

Open org in Grafana ↗

{{ tv.isoNote }}

Sites

{{ s.domain }} {{ s.statusLabel }}

{{ p.label }}

Uptime

{{ s.uptimeStr }}

SSL

{{ s.sslStr }}

WAF

{{ s.wafStr }}

Atk

{{ s.attackStr }}

{{ s.label }}

{{ s.value }}

{{ s.sub }}

{{ e.time }}

{{ e.src }}

{{ e.title }}

{{ e.meta }}

{{ e.verdict }}

Explore ↗ + IRIS

Open in Explore ↗

{{ k.label }}

{{ k.value }}

{{ k.sub }}

{{ m.ioc }}

{{ m.type }}

{{ m.tenantName }} · {{ m.asset }}

{{ m.event }}

{{ m.lastSeen }}

Explore + IRIS Block

No IOC matches in window — no asset touched a known-bad indicator. ✓

{{ iocResult.verdict }}{{ iocResult.q }}

{{ iocResult.detail }}

Attacker activity · supporting context

Legend blocked challenged allowed / observed

Open in Explore ↗ (deep-dive in SIEM)

{{ a.rule }}

rule {{ a.ruleId }} · {{ a.groups }}

L{{ a.level }}

{{ a.tenantName }} · {{ a.agent }}

{{ a.when }}

Explore + IRIS

{{ k.label }}

{{ k.value }}

{{ k.sub }}

{{ v.pkg }}

{{ v.cve }}

{{ v.cvss }}

{{ v.tenantName }} · {{ v.agent }}

{{ v.fix }}

Posture by tenant · Wazuh SCA + framework rule tags

{{ c.tenantName }}org {{ c.org }}

{{ f.name }}{{ f.score }}%

Compliance report ↗

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Per-tenant SLA · MTTA / MTTR vs contractual target

{{ r.tenantName }}

{{ r.mtta }}

{{ r.target }}

{{ r.mttr }}

{{ r.statusLabel }}

Client {{ reportSel.plan }} {{ reportSel.availLabel }}

{{ rep.title }} {{ rep.badge }}

{{ rep.cadence }}

Open report Template in build Requires {{ rep.reqPlan }}

Live data seam: reports currently render representative figures. The orchestrator will populate them from Wazuh (detections/agents), Loki + Grafana (WAF/uptime), IRIS (cases), and the vuln feed — see docs/CLIENT_REPORTS.md.

{{ c.ref }}

{{ c.sevLabel }}

{{ c.title }}

{{ c.scope }} · {{ c.created }}

{{ c.objLabel }}

{{ c.objSub }}

Escalate Open ↗

{{ t.label }} · {{ t.count }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Open Grafana Explore ↗

{{ h.label }}

{{ h.value }}

{{ h.sub }}

Per-client telemetry · worst first

{{ c.name }}

{{ c.slug }}

Agents

{{ c.agents }}

{{ c.discNote }}

Alerts

{{ c.alerts }} {{ c.trendLabel }}

this window

Critical

{{ c.critical }}

L≥12

Top rule{{ c.topRule }}

Ingest freshness{{ c.fresh }}

Open in Grafana ↗ Alerts Cases

Grafana dashboards · {{ launcherCount }} deep-link · no token · Cloudflare Access authenticates you

{{ d.name }}

{{ d.healthLabel }}

{{ d.detail }}

{{ d.iso }}

{{ k.label }}

{{ k.value }}

{{ k.sub }}

Plan catalog · entitlements

{{ p.label }}{{ p.price }}/mo

{{ p.limitsLine }}

{{ ft.sym }}{{ ft.label }}

Open Zoho Billing ↗

{{ b.name }}

{{ b.zohoId }}

{{ b.plan }}

{{ b.addonLine }}

{{ m.label }}{{ m.text }}

{{ b.invLabel }}

auto-suspend pending

{{ b.mrr }}

Manage Suspend Reactivate Zoho ↗

Zoho is the billing system of record & customer-facing surface (hosted invoices + client portal). This screen is internal control/visibility only — no card data is handled here. Enforcement: UI upsell → orchestrator gate → provisioning limits → auto-suspend on non-payment. See docs/BILLING_ENTITLEMENTS.md.