Overview

The overview is where a session starts. It answers one question at a glance: what is my network talking to right now, and is anything wrong?

The globe

A dark globe with your site as a single point and every active external connection as an arc from it, drawn in the direction of the data.

Element	Encodes
Arc thickness	Bytes
Arc colour	Live traffic — one colour, not a severity scale
Arc opacity	Raised by a high or critical incident on that path
Home point	Your configured site coordinates
Ring on an arc	A destination never seen before, held for ten seconds

The colour is worth a sentence, because it is a deliberate constraint rather than an oversight. Orange on the globe means “traffic is flowing”, not “this is bad”. A serious incident raises the opacity of an arc, never its hue, so the picture never turns into a threat-level map that is impossible to read at a glance.

Beside the globe sits a list of countries and networks with device counts and byte totals. Clicking an entry zooms the globe to it.

The globe rotates slowly and stops on interaction. A quiet switch turns off rotation, particles and pulses entirely — for a wall display, or for a laptop without a GPU.

If the globe is empty

Three ordinary reasons, in order of likelihood:

1. No GeoIP databases. Without them the geo fields are null and the globe draws nothing, because it does not invent locations. See GeoIP.
2. No home coordinates. A tenant without configured coordinates has no origin to draw from.
3. No external traffic in the window. The default window is the last 15 minutes.

The incident rail

Down one side: the open incidents, sorted by score. Each card carries its title, severity, the affected devices, and a short summary. Clicking one opens the incident dialog without leaving the view, and the URL changes with it, so an incident is a link you can send to someone.

On a fresh installation this rail is empty on purpose. See the learning phase.

The data-state line

Always visible: how fresh the data is, and whether every source is delivering. It links into the system view.

This is not decoration either. A dashboard that looks the same whether or not it is receiving data is a dashboard that lies. If a source is stale, the overview says so before you draw any conclusion from what it is showing.

Bounds

The view is bounded so that it stays legible and cheap:

• at most 300 arcs on the globe, with the remainder aggregated per network,
• at most 500 nodes and 2,000 links in the network map,
• a total particle budget, above which small flows are drawn without particles.

When aggregation happens it is explicit in the data — a cluster node says how many members it stands for — rather than silently dropping the rest.

Updates arrive as deltas over a server-sent event stream: nodes and links are mutated rather than rebuilt, so the layout stays still while the data moves.