Skip to main content

📊 Dashboard

The GuardianKey Auth Security Web Dashboard is the central interface for administration and monitoring. It allows administrators to view authentication events, configure risk-based response policies, manage notifications, and analyze user behavior in real time.

🏢 Organization​

The dashboard supports multiple Organizations, each representing a logically isolated instance, such as a company or business unit. Each organization has:

  • Complete isolation of data and configurations
  • Administrators with specific permissions
  • Internal user groupings called authgroups

👥 AuthGroups (Authentication Groups)​

Authgroups are logical groups within an organization, used to:

  • Group related users or systems
  • Apply risk and notification policies granularly
  • Share or isolate behavioral profiles between different applications

Each authgroup has:

  • Its own risk policy
  • Specific notification rules
  • Independent event history and profile

Example: Separate authgroups for the financial system and the support system, each with different rules and responses.

🛡️ Risk Policies​

Risk policies are applied per authgroup and define actions to be taken based on the risk score calculated by GuardianKey.

For each risk range, you can configure:

  • ✅ ACCEPT – access granted
  • ✉️ NOTIFY – notification via email or webhook
  • ⚠️ HARD NOTIFY – notification with user confirmation request
  • ❌ BLOCK – access denied, even with valid credentials

These actions are configurable and can be edited at any time in the dashboard.

🔔 Notifications​

Each authgroup can have its own notification rules. There are two main delivery methods:

Email (SMTP)

  • Can be sent to:
    • Only the user
    • User and administrator
    • Only the administrator
  • The email contains a link to a confirmation page, where the user can indicate if the access was legitimate

Webhook (HTTP/REST)

  • Enables integration with third-party systems (SIEM, ticketing tools, dashboards, etc.)
  • Sends event data and risk score in real time

📈 Dashboards and Event Visualization​

The dashboard provides interactive graphical dashboards with:

  • Geographic map of accesses
  • Risk distribution by group, system, or user
  • Accumulated charts by period
  • Detailed event listing with filters by:
    • IP, score, status, threat type, location, browser/OS

You can also view:

  • User event timelines
  • Behavioral statistics by authgroup
  • Access analysis by ASN, location, browser, and device

AI Assistant and Explainable Analytics​

The administration console includes an AI assistant integrated into the GDN interface. Administrators can use natural language (NLP) to query authorized security data and receive structured answers and dynamic visualizations. The assistant can also generate reports and retrieve statistics directly from the available data.

AI-powered explanatory analyses provide automatic summaries and highlight the factors that contributed to the assessed risk. According to the configured LLM model and the data available to the administrator, the panel can present metrics such as:

  • users generating the highest number of security events;
  • IP addresses and cities recurring most often in incidents;
  • event types organized by severity and frequency;
  • trends detected automatically by AI.

The assistant observes the same organization scope and access permissions as the authenticated administrator.

Recurring IP and Device Analysis​

Each event can carry a stable device identifier (device_uuid) supplied by the integration. The event explorer can filter records by this identifier, allowing an administrator to isolate a device, count its recurrence, and review the incidents and users associated with it. The user view also presents device history and behavioral frequency, while rankings identify the IP addresses and device UUIDs with the highest event counts.

Scheduled and Differential Reports​

Reports can be generated automatically through recurring schedules and background processing. A scheduled task can generate complete and differential reports in Markdown and PDF, retain report history, and deliver the results to configured recipients.

The differential report compares the current analysis with previous executions and automatically highlights new or recurring suspicious users, IP addresses, conditions, and threat-intelligence findings. AI-assisted summaries provide context for the detected changes and trends.

Processed events, risk scores, alerts, and report outputs can be sent to external monitoring and analytics platforms, including SIEM and BI solutions, through the supported HTTP/REST integration channels.