Console Overview
The Tamandua Sentinel Console provides a centralized web-based interface for managing your endpoint security infrastructure. This guide covers the console layout, navigation, key metrics, and user role management.
Accessing the Console
Access the Tamandua Sentinel Console through your browser at your organization's configured URL (typically https://your-domain.tamandua.io or your self-hosted instance).
Supported Browsers
- Google Chrome 90+
- Mozilla Firefox 88+
- Microsoft Edge 90+
- Safari 14+
Login Methods
- Email/Password: Standard authentication with optional MFA
- SSO/SAML: Integration with identity providers (Okta, Azure AD, Google Workspace)
- API Key: For programmatic access and automation
[Screenshot: Login page with SSO options]
Dashboard Layout
The console follows a three-panel layout designed for efficient security operations.
Navigation Panel (Left)
The left navigation panel provides access to all major console areas:
| Section | Description |
|---|---|
| Dashboard | Overview metrics and real-time status |
| Alerts | Security alerts and threat notifications |
| Agents | Endpoint agent management |
| Investigations | Threat hunting and incident response |
| Detection | Rules, signatures, and ML models |
| Live Response | Remote endpoint interaction |
| Reports | Scheduled and ad-hoc reporting |
| Settings | System and user configuration |
[Screenshot: Left navigation panel expanded]
Header Bar (Top)
The header bar contains:
- Organization Selector: Switch between managed organizations (for MSSP deployments)
- Global Search: Search across alerts, agents, and indicators
- Notifications: Real-time alert notifications
- User Menu: Profile settings, preferences, and logout
[Screenshot: Header bar with organization selector]
Main Content Area (Center)
The main content area displays the selected view with:
- Breadcrumb Navigation: Current location in the console hierarchy
- Action Toolbar: Context-specific actions and filters
- Data Grid/Visualization: Primary content display
- Detail Panel: Slide-out panel for item details
Key Metrics
The console surfaces critical security metrics across all views.
Dashboard Metrics
| Metric | Description |
|---|---|
| Active Agents | Endpoints currently reporting telemetry |
| Offline Agents | Agents not reporting within configured threshold |
| Open Alerts | Unresolved security alerts requiring attention |
| Critical Alerts | High-severity alerts in the last 24 hours |
| Detection Coverage | Percentage of endpoints with active detection |
| Mean Time to Detect (MTTD) | Average time from threat activity to alert generation |
| Mean Time to Respond (MTTR) | Average time from alert to containment |
Real-Time Indicators
- Agent Health: Green (healthy), Yellow (degraded), Red (offline/error)
- Threat Level: Organization-wide threat posture indicator
- Processing Pipeline: Telemetry ingestion and detection pipeline status
[Screenshot: Dashboard with key metrics widgets]
Navigation
Keyboard Shortcuts
| Shortcut | Action |
|---|---|
G then D | Go to Dashboard |
G then A | Go to Alerts |
G then E | Go to Agents (Endpoints) |
G then I | Go to Investigations |
/ | Focus global search |
? | Show keyboard shortcuts |
Esc | Close modal/panel |
Quick Actions
Access quick actions from any screen using Cmd+K (Mac) or Ctrl+K (Windows/Linux):
- Create new investigation
- Search for IOCs
- Run live response command
- Generate report
[Screenshot: Quick actions command palette]
Breadcrumb Navigation
Navigate hierarchies efficiently:
Dashboard > Alerts > Alert #12345 > Related Events
Click any breadcrumb segment to navigate directly to that level.
User Roles
Tamandua Sentinel implements role-based access control (RBAC) with predefined and custom roles.
Predefined Roles
Administrator
Full system access including:
- User and role management
- System configuration
- License management
- Audit log access
- All operational capabilities
Security Analyst
Day-to-day security operations:
- View and manage alerts
- Create and manage investigations
- Execute live response commands
- Generate reports
- View agent status
SOC Manager
Team oversight and reporting:
- All Security Analyst permissions
- Team management
- Escalation configuration
- SLA monitoring
- Executive reporting
Threat Hunter
Advanced threat detection:
- All Security Analyst permissions
- Custom query creation
- Detection rule authoring
- Threat intelligence management
- IOC management
Read-Only
View-only access for:
- Dashboard viewing
- Alert viewing (no actions)
- Report viewing
- Agent status viewing
Custom Roles
Create custom roles by combining granular permissions:
| Permission Category | Examples |
|---|---|
| Agents | View, Edit, Delete, Isolate, Uninstall |
| Alerts | View, Assign, Resolve, Delete, Suppress |
| Investigations | View, Create, Edit, Close, Delete |
| Detection | View Rules, Edit Rules, Deploy Rules |
| Live Response | Connect, Execute Commands, Transfer Files |
| System | View Settings, Edit Settings, Manage Users |
[Screenshot: Role configuration page]
Role Assignment
Assign roles at multiple levels:
- Organization Level: Default role for all organization resources
- Agent Group Level: Override for specific endpoint groups
- Investigation Level: Specific investigation access
Multi-Organization Access (MSSP)
For managed security service providers:
- Users can have different roles per customer organization
- Organization-level isolation ensures data separation
- Cross-organization views for SOC management
- Consolidated dashboards for service delivery
Session Management
Session Security
- Timeout: Configurable idle session timeout (default: 30 minutes)
- Concurrent Sessions: Limit simultaneous logins per user
- Session Binding: Optional IP address binding
- Secure Cookies: HTTPOnly, Secure, SameSite flags enabled
Audit Trail
All console actions are logged:
[2024-01-15 14:32:45] user@example.com performed alert.resolve on Alert #12345
[2024-01-15 14:31:22] admin@example.com performed agent.isolate on endpoint-001
[2024-01-15 14:30:01] analyst@example.com performed investigation.create
Access audit logs via Settings > Audit Log or export for SIEM integration.
Console Themes
Light Mode
Default theme optimized for daytime use with high contrast.
Dark Mode
Reduced eye strain for extended monitoring sessions. Toggle via user preferences or system theme detection.
[Screenshot: Dashboard in dark mode]
Mobile Access
The console is responsive and supports tablet access for:
- Alert triage
- Agent status monitoring
- Investigation review
For full functionality, desktop access is recommended.
Next Steps
- Dashboard Guide - Learn about dashboard widgets and customization
- Agent Management - Manage your endpoint agents
- Alert Management - Handle security alerts effectively
- Investigations - Conduct threat investigations
- Live Response - Execute remote commands on endpoints