VEIL / restricted workspace
Turn observations
into understanding.
Explore sensor activity, investigate signals, and manage collection from one secure workspace.
Invitation onlyAuthenticator requiredRole-based access
Collection intelligence
Activity overview
Waiting for first refresh…
Sensor—
Campaign—
Emulation profile—
Effective stateUnknown
EdgeUnknown
Campaign expiry · UTC—
Waiting for delivery heartbeat…
Hourly history
InitializingCommitted request totals
Preparing historical projections…
Activity over time
24 intervals · selected sampleRequest distribution
Analytics use a bounded, newest-first sample of sanitized events.
Requested surface
Top request paths
Waiting for data
Detection
Matched signals
Waiting for data
Event explorer
Waiting for eventsRecent observations
Filters apply to the latest 200 loaded events, not the full archive. Select a request to inspect its sanitized metadata.
| Observed · UTC | Source | Request | Severity | Signals | Bytes |
|---|
Audited operations
Collection controls
Reading collection state…
Pause stops new evidence capture after a short propagation interval. Resume cannot override campaign expiry or an emergency shutdown.
Profiles, network access, expiry extensions, and deployment configuration remain reviewed infrastructure changes.
Workspace administration
Invitations expire after 3 daysPeople and access
Viewer: aggregate analytics. Analyst: sanitized event investigation. Operator: collection controls. Each role receives only its stated capabilities.
| User | Status | Roles |
|---|
Admin creation and account disablement require a trusted AWS operator. Disabling an account does not instantly invalidate already-issued JWTs.
Cost containment · read only
Cumulative usage protection
Usage receipt has not been loaded.
| Measure | Window | Reported usage | Allowance | Hourly buckets |
|---|
Usage allowances are not a hard spending cap. AWS metrics are delayed and may be sparse; zero reported buckets do not prove zero traffic. Hourly boundaries round outward, so the rolling day can cover almost 25 hours. Automatic shutdown does not automatically rearm. Infrastructure restoration requires explicit review.
Console collection changes
History has not been loaded.
| Revision | Time (UTC) | Action | Actor | Reason |
|---|
Deployment baseline · read only
Profile and safety configuration
Declared at deployment, not a live drift inspection. This revision covers the fields shown and the selected profile artifact, not the entire infrastructure. Changes still require a reviewed infrastructure deployment.
- Profile
- Not loaded
- Profile artifact SHA-256
- —
- Capture and retention
- —
- Traffic controls
- —
- Campaign expiry
- —
- Configuration revision
- —
Traffic controls and alarms are not a hard spending cap. Current pause, edge, and delivery health are reported separately.
Audited change workflow
Configuration proposals
Propose changes against a specific baseline, then record an administrator's review. Approval does not apply changes, extend the running campaign, or override shutdown controls.
Proposals have not been loaded.
| Created · UTC | Status | Reason | Proposer | Review |
|---|
Trusted operator execution
Configuration deployments
A trusted AWS operator applies a reviewed plan. Verified receipts confirm the recorded configuration checks; current collection and shutdown state are shown separately.
Deployment history has not been loaded.
| Started · UTC | Result | Proposal | Details |
|---|
Durable intent and outcomes
Invitation history
Invitation history has not been loaded.
Email submission is not proof of delivery. Unconfirmed outcomes require trusted investigation; the console does not resend email, adopt an existing account, or retry role assignment.
| Requested · UTC | Recipient | Role | Outcome | Reason | Operation |
|---|