Security Alerts

The Security Alerts dashboard monitors and displays real-time security events detected by the Telemore Monitor daemon.

Alert Types

Type	Icon	What It Detects
USB Mount	USB icon	Removable storage device connected to the machine
USB Unmount	USB icon	Removable storage device disconnected
Process Blocked	Block icon	An application from the blocklist was launched
Clipboard DLP	Clipboard icon	Sensitive data pattern detected in clipboard (SSN, credit cards, API keys)
Network Anomaly	WiFi icon	Suspicious outbound network connection detected
Security Alert	Warning icon	General security event

Severity Levels

Each alert has a severity level with distinct color coding:

Severity	Color	Use Case
Critical	Red (#ef4444)	Immediate attention required (e.g., data exfiltration attempt)
High	Orange (#f97316)	Significant security concern (e.g., blocked process launch)
Medium	Yellow (#eab308)	Notable activity (e.g., USB mount during business hours)
Low	Blue (#3b82f6)	Informational (e.g., routine USB activity)

Dashboard Layout

Summary Cards

Four cards at the top showing counts for the selected time range:

• Critical — count with red highlight if > 0
• High — count with orange highlight if > 0
• Medium — count
• Total — all alerts combined

Filters

• Time Range — toggle between 1h, 24h, 7d, and 30d windows
• Severity — filter by All, Critical, High, Medium, or Low

Alert Table

Each alert row shows:

• Type icon (color-coded by severity)
• Severity chip
• Event type label
• Alert description
• Timestamp
• Details — metadata chips showing relevant context:
  • process_name for blocked processes
  • remote_addr:remote_port for network anomalies
  • path for file system events
  • pattern for DLP matches (shown in red)

Auto-Refresh

The alert list refreshes automatically every 30 seconds. Click the refresh button for an immediate update.

Daemon Requirement

Security alerts require the Telemore Monitor daemon to be running. If the daemon is offline, the page shows a "Security Monitor Offline" message with a Start Daemon button.

Data Source

Alerts are queried via daemonService.querySecurityAlerts(from, to, severity) from the local daemon's event database and synced to the server.