Dashboard Overview
The Flowtriq dashboard is your central command center for monitoring infrastructure, investigating incidents, and managing nodes. This guide covers every element on the main overview page and how to navigate the full dashboard.
Main Overview Page
When you log in, you land on the Overview page. This page provides a real-time snapshot of your entire deployment through four key areas: stat cards, the node status grid, the setup checklist, and recent incidents.
Stat Cards
Four stat cards span the top of the overview page. They update automatically every 3 seconds via live polling:
| Card | What It Shows |
|---|---|
| Total Nodes | Number of registered and active nodes in your workspace. Does not include deleted or demo nodes. |
| Nodes Online | How many of your active nodes have checked in recently. A green pulse dot indicates the live connection. Shows "of N active nodes" below the count. |
| Active Incidents | Currently ongoing attacks (status = active). Turns red when any incidents are active. |
| Incidents (Period) | Total incidents detected within the selected time range (24h, 7 Days, 30 Days, or 90 Days). Use the range pills in the top-right corner to change the window. |
Time Range Selector
In the top-right corner of the overview heading, four pills let you switch the time range: 24h, 7 Days, 30 Days, and 90 Days. The Incidents stat card and related counts update based on this selection.
Customize Button
Click Customize in the top-right to enter layout editing mode. In this mode you can:
- Reorder widgets by dragging them with the grip handle
- Toggle visibility of individual widgets with the eye icon
- Reorder stat cards independently within the stat row
- Save Layout to persist your changes
- Reset to Default to restore the original widget order and visibility
Your layout is saved per-user, so each team member can customize their own view.
Node Status Grid
The node grid shows a card for every active node. Each card displays:
- Status dot (colored circle indicating current state)
- Node name
- IP address
- Current PPS (packets per second), updated live
- Status badge (Online, Offline, Attack, Elevated)
- Location (if configured)
Click any node card to navigate to its detail page with live PPS charts and configuration options.
Recent Incidents Table
The bottom section lists the 10 most recent incidents. Columns include:
- Node and incident title
- Attack Family (UDP Flood, SYN Flood, HTTP Flood, etc.)
- Severity (Low, Medium, High, Critical)
- Peak Traffic (PPS for network-layer attacks, RPS for HTTP floods)
- Duration (or "ongoing" for active incidents)
- Started (relative time, e.g. "3m ago")
- Status (Active, Resolved, False Positive)
Click any row to open the full incident detail page.
Node Status Indicators
Every node has a status that updates in real time:
| Status | Badge Color | Meaning |
|---|---|---|
| online | Green | The agent is running and reporting metrics normally. No active incidents. |
| offline | Gray | The agent has not sent a heartbeat recently. This could mean the agent process stopped, the server is down, or a network issue is preventing communication. |
| attack | Red | The node has at least one active incident. Traffic has exceeded the detection threshold. |
| elevated | Yellow | Traffic is above normal baselines but has not crossed the attack threshold. The node is in a warning state. |
| unknown | Gray | The node was recently created and has not yet sent its first heartbeat. |
Setup Checklist
When your workspace has incomplete setup steps, a Complete Your Setup checklist appears on the overview page. It tracks your onboarding progress with a percentage bar and guides you through each step:
- Deploy your first node - Install the agent on a server to start monitoring. If you indicated a fleet size during signup and have fewer nodes deployed, this step prompts you to expand your deployment.
- Set up alert channels - Configure at least one notification channel (Slack, Discord, PagerDuty, email, or 13 other channels).
- Explore sample attack (trial users only) - Review the pre-loaded sample attack to see what detection looks like, including the AI summary, timeline, and PCAP data.
- Enable auto-mitigation - Create firewall rules, BGP FlowSpec, or RTBH rules for automated attack response.
- Build an automated runbook - Chain detection, alerting, and mitigation into automated response playbooks.
- Configure cloud scrubbing - Set up upstream scrubbing to divert and clean traffic during volumetric attacks.
Each item can be manually checked off or will auto-complete as you configure the feature. You can collapse the checklist by clicking its header, or dismiss it permanently by clicking Dismiss at the bottom.
Sidebar Navigation
The left sidebar provides access to every section of the dashboard:
| Menu Item | Description |
|---|---|
| Overview | The main dashboard page described above |
| Nodes | Add, manage, configure, and monitor your nodes |
| Incidents | Full incident list with search, filtering, and bulk actions |
| Analytics | Historical trends, charts, and aggregate statistics |
| Alert Channels | Configure notification destinations (Slack, Discord, PagerDuty, etc.) |
| Mitigation | Firewall rules and automated response configuration |
| Runbooks | Automated response playbooks |
| Reports | Generate incident, monthly, and compliance reports |
| Maintenance | Schedule maintenance windows to suppress alerts |
| Team | Manage workspace members and roles |
| Settings | Profile, workspace, security, and API settings |
| Audit Log | Full audit trail of all actions in your workspace |
Workspace Switcher
If you belong to multiple workspaces, use the workspace switcher in the sidebar header to move between them. Each workspace has its own nodes, incidents, team members, and settings.
Quick Start Guide (Empty State)
If you have zero nodes, the overview page displays a dedicated Get Started card with step-by-step instructions to deploy your first agent. Once you have one node, a banner offers a link to the mass deployment guide for scaling across your fleet.
FAQ
How often does the dashboard update?
The overview page polls every 3 seconds for live data updates. Node PPS values, status indicators, and incident counts all refresh automatically without a page reload.
Can I customize which widgets appear?
Yes. Click the Customize button in the overview header. You can hide, show, and reorder any widget. Your layout is saved per-user.
What is the "elevated" status?
Elevated means the node's traffic is above its learned baseline but has not crossed the attack threshold. Think of it as a yellow warning. If traffic continues to rise, the status will change to "attack" when an incident is opened.