Agents tab

The identity center for kilasec. Every distinct source of traffic gets one card; the page surfaces why it's named the way it is and lets the admin override when the network's guess is wrong.

Screenshot: Agents page with named + unnamed cardsdocs/public/screenshots/agents.png

Layout

• Header — title, count ("12 discovered"), short blurb.
• Filter pills — All / Unnamed / People / Agents. Unnamed always bubbles to the top of the list (they're the actionable items).
• Cards — two-column grid, one card per cluster.

Cluster key — what makes "one card"

A cluster is one card. The cluster key is the strongest stable identifier across the events in the group. In priority order:

1. Agent name if it's a real name (not unknown_agent / unknown).
2. Hostname (from DHCP / reverse-DNS / mDNS / manual).
3. Source IP.
4. "unknown" — only happens when neither IP nor hostname is captured.

This is critical for usability: without this, every nameless host collapses into one mega-cluster called unknown_agent. With it, you get one card per host — even if none of them has a name.

Card content

Every card shows the same shape:

Header row:

• A dot (green = named, faint = unnamed).
• The display name (mono).
• A principal-type pill (user / agent / service) when known.
• An edit button (always available).

Provenance sub-line:

from network · 10.0.3.42 · mwilson-mbp — tells you which source was used for the display name, the source IP(s), and the hostname (if different from the displayed name).

Stats:

calls · denied · redacted plus the verdict-mix bar.

Identity signals (for named cards):

A read-only audit trail of what we know about this source.

✓ Name — from reverse_dns
✓ Source IP — 10.0.3.42
✓ Hostname (reverse_dns) — mwilson-mbp.acme.local
✓ User-agent — claude-cli/0.7

Suggested names (for unnamed cards):

A clickable list of names the cluster could have, from the strongest signal first.

From reverse_dns  → mwilson-mbp        [use →]
From User-Agent   → claude-cli          [use →]
From IP           → host-10.0.3.42     [use →]

Clicking any one immediately adopts it as a manual override and the card flips to the "named" view.

Top destinations:

The four most-hit destinations for this cluster, with counts.

Footer:

last seen <X> ago · Inspect decisions → — jumps to Live Traffic with the agent name pre-filtered.

Inline rename

Click edit → a row appears with three controls: name (text), principal type (select), Save / Reset / Cancel buttons.

• Save persists the override and replaces the displayed name immediately.
• Reset clears any manual override and reverts to the strongest network-derived name (or back to "unnamed" if there isn't one).
• Cancel discards the unsaved edit.

The override is keyed on the cluster's identifier (the same one the cluster is grouped on). Currently stored client-side in localStorage under kilasec.identities. The cloud-backed /v1/identities table replaces it in an upcoming release; the UX stays identical.

Filter pills

Pill	Shows
All	every cluster
Unnamed	clusters where named === false (no DHCP / DNS / mDNS / manual mapping yet)
People	principal_type === "user"
Agents	principal_type === "agent"

A red "Unnamed N" pill is the page's main work surface — N is the number of things waiting for you to name.

When to use the Agents tab

• Onboarding — your day-1 view is mostly unnamed. Walk down the list, click suggestions to adopt names.
• Audit prep — to confirm every cluster has a recognisable owner before a quarterly review.
• Investigation — from a suspicious event on Live Traffic, click the agent name to land here and see the full picture (top destinations, verdict mix, when it first appeared).

→ See Naming agents for the playbook, and Concepts: Identity model for the resolution chain in detail.