Dashboard tab

The first surface every admin sees after sign-in. Designed to answer "is anything on fire" in five seconds.

Screenshot: /app/ (Dashboard) — full pagedocs/public/screenshots/dashboard.png

Layout

Four parts, top to bottom:

1. Page header — title, "Last 24 hours" pill, time-range selector, Export CSV button.
2. KPI strip — four cards: AI requests / Blocked / Sensitive data caught / Spend (24h).
3. Traffic chart + Top destinations — stacked 24-hour bar chart (cobalt = allowed, slate = blocked) next to a ranked list of destinations.
4. Recent incidents — table of the most recent denies / redacts / awaiting-approvals.

KPI cards

Each card shows three things: a label, a tabular-numeric value, and a delta with arrow + sub-line.

Card	Source	Delta meaning
AI requests · 24h	count of decisions, last 24h	vs. prior 24h
Blocked	deny + require_approval, last 24h	vs. prior 24h, red when rising
Sensitive data caught	redact count, last 24h	vs. prior 24h
Spend (24h)	sum of cost_usd from /principals/summary	vs. prior 24h, green when falling

Deltas only render when there's a real prior-24h baseline. If you just installed kilasec, you'll see → — for the first day.

When the collector hasn't emitted cost yet (/principals/summary returns cost_usd: 0), the Spend card shows — · no token data yet instead of $0.00. This is the right thing — false zeros are misleading.

Traffic chart

Stacked bars, 24 of them, one per hour. Each bar's height is allow + blocked for that hour; the split is allowed-on-bottom (cobalt) and blocked-on-top (slate). Axis labels at 00:00 / 06:00 / 12:00 / 18:00 / now.

Empty hours render as 1-pixel minimums so you can see the time dimension even on a quiet network.

Top destinations

Up to six rows. Each shows host · count plus a progress bar (% of top). Shadow hosts (anything matching a shadow_ai rule) render in red.

The list is updated on every SSE event — the bar widths recompute in real time as new decisions arrive.

Recent incidents

A small table of the most recent six rows where verdict ∈ {deny, redact, require_approval}. Each row has an Investigate button that jumps to Live Traffic with the filters pre-set.

Export CSV

Clicking Export CSV downloads kilasec-audit-<ISO-timestamp>.csv with the currently visible events (whatever's in decisions[] client-side, up to the 800-row in-memory cap). For larger windows, use the API directly:

curl -H "Authorization: Bearer $TOKEN" \
  "https://kilasec.com/api/audit/export?format=csv&window=86400" \
  -o audit.csv

Auto-refresh

The page polls real-time. SSE (/api/events) pushes new decisions into the in-memory list; the KPI strip + chart + provider list re-derive on every render. No manual refresh needed unless you've been disconnected longer than 30 seconds.

→ For the dense streaming view, switch to Live Traffic.