Dashboard
The dashboard (Monitor › Dashboard) is the landing page for administrators: mail flow, threats and the AI at a glance.
Live updates
The dashboard updates itself while it is open; there is no need to reload. The LIVE badge next to the heading shows the connection:
- LIVE
- Connected. Within a few seconds of a message being processed, released or reviewed by the AI, the figures, trend lines, chart, verdict mix and tables change in place. New threats flash briefly in Recent threats, and a notice in the corner says how many messages (and threats) arrived. The gateway status and queue in the top bar refresh at least once a minute.
- RECONNECTING
- The connection dropped (network, a restart of the gateway); the browser reconnects by itself within seconds.
- PAUSED
- The tab is in the background. Updates stop to save work on the gateway and resume as soon as you come back.
A table does not change while the mouse is over it, so a row never moves just as you click it; it catches up when the pointer leaves. Your chart view and threat filter stay as you set them.
Top bar
- Live status
- Whether Postfix is running (GATEWAY ONLINE), the average AI review time in the period, and how many messages are in the Postfix queue (amber while any are deferred). Hidden on narrow windows.
- Search and jump
- Opens the command palette - also Ctrl+K (⌘+K on a Mac) or / on any page. Type part of a page name to jump to it, or paste a sender, subject, message ID, queue ID or IP address and pick Trace to search Message trace (last 30 days). Arrow keys move, Enter opens, Esc closes.
- 24h / 7d / 30d
- The period for every figure on the page. The chart shows 7 days for 24h and 7d, and 30 days for 30d.
- Organization
- MSP administrators with more than one organization can scope every number to one of them. Organization administrators always see only their own.
Quick actions
- Run message trace
- Opens the command palette ready to trace.
- EICAR self-test
- Scans a built-in message carrying the harmless EICAR anti-virus test file through every stage and shows the result as on Test a message. Nothing is sent or stored. ClamAV should report
Eicar-Signature; if it does not, check System health.
Mail flow
Four connected steps, each with a trend line for the period. Click a step to open the matching messages.
- 01 Messages
- Everything processed, split into inbound, outbound and API-scanned. The badge is the inbound share.
- 02 Threats stopped
- Phishing + BEC + virus + malware verdicts, and their share of all mail. "clawed back" counts delivered messages later removed from mailboxes after an AI review.
- 03 Spam
- Spam + block-listed + attachment-policy verdicts, and how many bulk messages were tagged. The badge is spam and bulk together as a share of all mail.
- 04 In quarantine
- Recipient copies currently quarantined (all time, not just the period), and how many are held waiting for the AI. Review opens the quarantine.
The heading shows the clean delivery rate: the share of messages with a clean verdict.
Volume chart
Messages per day. On a normal day clean mail outnumbers threats by hundreds to one, so the chart has four views:
- Dual axis
- The default. Clean mail as bars on the left scale; threats (solid line) and spam + bulk (dashed line) on their own scale on the right, so a handful of threats stays visible.
- Threats only
- Clean mail left out: phishing / BEC, virus / malware, spam and bulk stacked per day.
- Log scale
- Every verdict on a logarithmic scale, so large and small counts sit side by side in proportion.
- Stacked
- All verdicts stacked on one ordinary scale.
The browser remembers the view you picked. The legend shows each verdict's total for the chart period and the busiest day.
AI analysis
- Reviewed
- Messages the model finished reviewing in the period.
- Waiting for the model
- Messages whose AI review is queued or running. A number that keeps growing means the model host is slow or down - check System health.
- Clawed back after delivery
- Async-mode messages the model flagged after delivery and that were pulled from mailboxes.
- Average review time
- Mean time per review over the most recent 200 in the period.
Verdict mix
Count and share of each verdict in the period. Colours mean the same thing everywhere: green clean, grey bulk, amber spam and policy, red phishing / BEC / blocked, magenta virus and malware. Click a verdict to list those messages.
Recent threats
The last ten phishing / BEC / virus / malware messages, with the first recipient. All / Phish / Virus filters the list. all → opens Message trace with every threat in the period.
Click a row to open the message inspector beside the dashboard: the envelope and what the gateway did, SPF / DKIM / DMARC results, the AI verdict, the rules that fired with their scores, and an excerpt of the headers (with a Copy button). From there Block sender adds the address to the block list of the message's organization (the global list for mail without one), Release (for quarantined or held mail) delivers it, and Full trace opens the complete message page. Esc or the X closes the inspector. Ctrl-click a row to open the full page in a new tab instead.
Top unwanted senders
Addresses that sent the most non-clean, non-bulk inbound mail in the period, with a bar for relative volume. Hover a sender for Block (adds it to the block list of the organization it mailed; asks first) and Trace (all its messages in Message trace). Senders already on a block list are struck through and marked BLOCKED.
Themes and the sidebar
Theme at the bottom of the sidebar cycles through three looks, remembered per browser: Volcanic Glass (dark), Daylight Bento (light, with the dashboard drawn as one seamless grid) and Tactical SOC (navy, sidebar collapsed to icons). Until you pick one, the console follows your system's light or dark setting. The « button next to the logo collapses the sidebar to icons, or expands it again, in any theme.