Dashboard

What it's for

The dashboard is your daily entry point. It aggregates the state of your entire organization into a handful of counters and lists, without having to go through each host. Three complementary views are available:

• the summary (/dashboard): counters and recent incidents;
• the status overview (/status): detailed counters (hosts, failing checks, incidents, storms, workers);
• the real-time event feed (/events): updated automatically.

A fourth view, the application security dashboard (/dashboards/app-security), projects your hosts and incidents into a posture grid by sub-category.

All of these views are read-only and accessible to all roles.

Using it from the portal

When you log in, the dashboard shows:

• Hosts total: total number of hosts, and how many are active;
• Checks enabled: number of enabled checks;
• Incidents open: number of open incidents;
• Recent Incidents: the most recent incidents, with their severity and status.

The page refreshes automatically thanks to the event feed: counters and the incident list update live, with no action on your part.

Using it through the API

Dashboard summary

GET /api/v2/dashboard returns the key counters and the 5 most recent incidents.

curl -s https://api.secumon.secuaas.ovh/api/v2/dashboard \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "hosts_total": 12,
  "checks_enabled": 34,
  "incidents_open": 2,
  "recent_incidents": [
    {
      "id": "9d8c7b6a-1234-4abc-9def-001122334455",
      "title": "web-prod-01 no longer responds to ping",
      "severity": "critical",
      "status": "investigating",
      "created_at": "2026-06-23T11:58:00Z"
    }
  ]
}

Status overview

GET /api/v2/status returns a compact view of counters, handy for a monitoring screen or a widget.

curl -s https://api.secumon.secuaas.ovh/api/v2/status \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "hosts":  { "total": 12, "active": 11 },
  "checks": { "total": 34, "enabled": 32, "failing": 1, "failing_pct": 3.1 },
  "active_incidents": 2,
  "active_storms": 0,
  "workers": 2
}

The failing counter reflects the checks whose latest result (over the last 15 minutes) is not OK.

Real-time event feed

GET /api/v2/events is an SSE (Server-Sent Events) feed: the server pushes the dashboard summary every 5 seconds, and a keep-alive comment (: ping) every 15 seconds. The connection stays open for up to 30 minutes.

curl -N https://api.secumon.secuaas.ovh/api/v2/events \
  -H "Authorization: Bearer $SECUMON_TOKEN"

data: {"hosts_total":12,"checks_enabled":32,"incidents_open":2,"recent_incidents":[...]}

: ping

data: {"hosts_total":12,"checks_enabled":32,"incidents_open":2,"recent_incidents":[...]}

Each data: line contains the same JSON object as GET /dashboard. This is the feed that powers the portal's automatic refresh.

Application security dashboard

GET /api/v2/dashboards/app-security builds a posture grid by projecting your hosts (the "projects") and your checks into four application security sub-categories, plus a top 10 of open incidents and a 30-day trend.

curl -s https://api.secumon.secuaas.ovh/api/v2/dashboards/app-security \
  -H "Authorization: Bearer $SECUMON_TOKEN"

{
  "generated_at": "2026-06-23T12:00:00Z",
  "projects": [
    {
      "name": "web-prod-01",
      "cells": {
        "dependency_vulnerabilities": { "sub_category": "dependency_vulnerabilities", "status": "ok", "open_findings": 0 },
        "container_image_hygiene":    { "sub_category": "container_image_hygiene", "status": "unknown", "open_findings": 0 },
        "runtime_compromise":         { "sub_category": "runtime_compromise", "status": "unknown", "open_findings": 0 },
        "network_security_posture":   { "sub_category": "network_security_posture", "status": "ok", "open_findings": 0 }
      }
    }
  ],
  "top_findings": [],
  "trend_30d": [ { "date": "2026-06-23", "opened": 1, "resolved": 0 } ],
  "totals_by_severity": { "critical": 1 },
  "totals_by_status": { "investigating": 1 },
  "sub_categories": [
    "dependency_vulnerabilities",
    "container_image_hygiene",
    "runtime_compromise",
    "network_security_posture"
  ]
}

A cell's status takes the values ok, warn, critical, stale or unknown.

Use cases

• NOC wall display: show GET /status on a loop for a permanent glance at overall health.
• Custom home page: consume GET /events to build your own real-time view.
• Posture review: use the application security dashboard to identify hosts for which a sub-category remains unknown (missing monitoring coverage) or critical.

Tips

• failing_pct in GET /status is a good synthetic indicator for a meta-monitoring alert ("more than X% of my checks are failing").
• The /events feed closes cleanly after 30 minutes: plan for automatic reconnection on the client side if you use it continuously.
• A stale cell in the application security dashboard signals a disabled check: re-enable it or delete it to keep the grid honest.