Events

Events are the records clabs sends when something happens: a process start, a network connection observed by intercept, CI activity, and so on. Open Events in the console to browse recent activity for your organization.

​

What you will see

Typical columns include: Exact columns may evolve; use the table headers in the live console as source of truth.

​

Filters

Use the Events page filters to narrow the feed:

• Installation — one enrolled machine
• Type — event kind
• Asset — optional asset id you stamped on clabs

Combine filters to answer questions like “what did this laptop do in the last hour?” or “show only intercept traffic for asset demo-box.”

​

Empty feed?

If Events is empty:

1. Confirm the installation exists and is not revoked
2. Confirm clabs is installed and configured (~/.config/clabs/)
3. Run clabs run (discover) or clabs intercept to emit activity, or trigger it from CI via github.sh
4. Refresh the Events page

See Troubleshooting for more.

​

Related

• Installations
• Intercept
• Environment variables