Events

Events are the records your sensors send when something happens: a process start, a network connection observed by intercept, CI activity, and so on. Open Events in the console to browse recent activity for your organization.

​

What you will see

Typical columns include: Exact columns may evolve; use the table headers in the live console as source of truth.

​

Filters

Use the Events page filters to narrow the feed:

• Installation — one enrolled machine
• Type — event kind
• Asset — optional asset id you stamped on the sensor

Combine filters to answer questions like “what did this laptop do in the last hour?” or “show only intercept traffic for asset demo-box.”

​

Empty feed?

If Events is empty:

1. Confirm the installation exists and is not revoked
2. Confirm clabs is installed and configured (~/.config/clabs/)
3. Run a sensor that emits activity (clabs discover, clabs intercept, or CI via github.sh)
4. Refresh the Events page

See Troubleshooting for more.

​

Related

• Installations
• Intercept
• Environment variables