Command Center

Job of this page

Command Center answers one question: what needs attention right now? It is the situational rollup at the start of a shift. It deliberately does not try to be Incidents, Hunt Ledger, NDR, and Detection Engineering at once.

When the control plane is reachable, the page loads a bounded list of tenant incidents, summarizes queue pressure (open, critical, unassigned and related counts), and presents a detection-oriented summary with tactic filtering into priority rows that deep-link into Incidents. Shell actions nearby point toward starting investigation, authoring detection content, connecting a source, or inviting an operator.

Live versus evaluation versus unavailable

Live mode fetches incidents from the control plane. If the API is unreachable, the page shows an honest empty or unavailable state and typically points toward Integrations — it does not invent a quiet, healthy queue.

Evaluation mode can load curated synthetic incidents for walkthroughs. That mode is labeled and optional. Switching into evaluation is an explicit exploration choice, not a silent fallback after a failed live fetch.

What you can do here

• Read queue pressure and severity load at a glance
• Filter detection-oriented priority by tactic into rows that open Incidents
• Use overload dampening behavior that reduces secondary chrome when volume is high
• Jump to investigation, detection authoring, integrations, or invites from nearby shell actions

What this surface is not

It is not case management. Open Incidents for ownership, deferral, evidence tabs, and response. It is not hunting proof — that is Hunt Ledger’s Checks / Findings / History. It is not the globe (Infrastructure Map) or internal NDR topology (/investigation). Some richer demo-only panels that appear in evaluation should not be read as live connector features when connectors are absent.