Skip to main content

Network Command Center

The Network Command Center is the human-in-the-loop (HITL) surface for network-detected attacks. It is the only dashboard page where an analyst can approve or deny an automated playbook execution against a network attack.

The page lives at /network-attacks in the dashboard (default http://localhost:3100/network-attacks).

What It Shows​

SectionPurpose
Attack listFilterable cards for every persisted network attack. Each card has an explicit Inspect / Focused control.
Attack FlowVisualises the focused attack's sequence and lateral movement.
Attack IntelligenceReasoning trail, IOC chips, telemetry source/family, sample events, and case/alert linkage.
Critical Approval QueuePending playbook approvals routed to the network surface. Visible only to users with the approvals:manage permission.
Dispatch panelSends the focused attack to a specialist agent with an analyst-editable prompt and priority.

HITL Approval Loop​

  1. A network detection produces an attack record and (optionally) a pending execute_playbook approval.
  2. An analyst with approvals:manage opens /network-attacks and selects the attack from the list.
  3. The Critical Approval Queue panel surfaces the pending decision. The analyst reviews the Attack Intelligence reasoning trail and IOCs alongside the approval payload before deciding.
  4. Approve runs decideApproval() followed by executePlaybook(playbook_id, { approval_id }) — the SOAR-side execution is gated on the recorded decision id.
  5. Deny records the decision with the reason Denied from Network Command Center. No playbook is executed.

The reason string for both branches is fixed (Approved from Network Command Center or Denied from Network Command Center) so audit logs can be filtered by surface.

Dispatching to a Specialist Agent​

The dispatch panel queues the focused attack to a specialist (default NetworkAnalyzer) via /api/v1/network-attacks/{attack_id}/dispatch. The most recent receipt is persisted on the attack record under telemetry.latest_dispatch_receipt so the assignment survives reloads.

The receipt deep-links into the agents queue:

  • selectedAgent — the agent that received the task.
  • selectedTask — the queued task_id.
  • agentTab — opens the agents page on the right tab.
  • backToAttack — round-trip link back to the originating attack.

Live-Read Degraded Mode​

If the dashboard is in dry-run or live-read-unavailable mode and the database is not reachable, the page surfaces an explicit notice:

Network Command Center reads require a live database in dry-run mode. Restore the database connection or switch to dummy mode for showcase-only use.

In that state the Critical Approval Queue is hidden — denying or approving an approval requires a live database round-trip and is never simulated.

Required Permissions​

ActionPermission
Read attacks, intelligence, dispatchAny authenticated session
See and act on the Critical Approval Queueapprovals:manage
Execute the resulting playbookplaybooks:execute (enforced server-side after approval)

Without approvals:manage the approval panel is hidden entirely — the rest of the page still works for read-only investigation.