Dashboard
Fleet health, open events and recent activity at a glance.
Healthy
—
agents
Current Users
—
active in 15 min
Relay Agents
—
registered
DB Size
—
— connections
Audit Events
—
this week
Service Health
TLS Certificates
Loading...
Recent Activity
Loading...
Agents
Every server running the SkaiBridge agent: status, version, mode and command profile.
Agents
Loading...
Audit Log
Every command run on your servers: who ran it, where, and the result.
Events
Display:
Loading...
Loading...
API Keys
Keys for the SkaiBridge API and for Prometheus scraping.
API keys
Loading...
Console
Run allowlisted commands on a server from an interactive terminal.
Select an agent to begin
SkaiBridge Agent Terminal — select an agent to begin.
$
Query
Ask about your own hosts, open issues and metric history. Read-only: answers are grounded in real data via tool calls, never guessed.
Ask a question, e.g. "what's open right now?" or "when did web-01 last check in?"
Token Usage
AI token usage over time.
Loading...
Loading...
Fleet Metrics
Metric families across the fleet, colored against your alert thresholds.
Loading...
Uptime Checks
Websites and APIs checked from outside your network: response, page text and certificate.
Loading...
Reports
Generate a report now, or have one emailed on a schedule.
Loading...
Security
Security posture across your fleet: findings by MITRE ATT&CK type, visibility gaps and correlated incidents.
Loading...
Actions
Automatic fixes for known problems: targets, triggers, dry runs and run history.
Loading...
Allowlist Library
What each server may run: commands, command groups, node groups and host lookup.
Loading...
Network Devices
Switches, routers and appliances that send SNMP traps to your collectors, and what the collectors receive.
Loading...
Settings
Password, two-factor sign-in, alert thresholds, integrations and organization settings.
Change password
Two-factor sign-in
Loading...
Organization info
Loading...
Autonomous Actions
Safe Remediation
When enabled, agents will automatically implement configured and approved fixes to specific problems. A ticket is always created regardless of outcome. Applies to all agents in this organization. i
Status:
AI Insight
Send log context to Insight
When on, AI Insight includes recent log lines from the affected host (masked, at most 20 lines) so its diagnosis can use them. The lines are sent to the SkaiBridge control plane and inference service. When off, Insight still works, using the event details and your organization's event history only. Applies to all agents in this organization.
Status:
Real-Time Alert Webhook
Sends a signed HTTP POST to your own endpoint the moment a new detection opens, or an existing one gets worse — never on a repeat of something already reported. Point this at anything that accepts an incoming webhook: Slack, Teams, PagerDuty, or your own service.
Enabled
Alert Thresholds
When a metric crosses a threshold the agent opens an event at that severity. Set organization defaults here, or pick a host to override it alone. A host uses its own value if set, otherwise the organization default, otherwise the built-in value.
Loading...
Grafana
Where the Grafana buttons on Fleet Metrics and on each host go. Use the Grafana stack Relay Labs set up for you, or your own Grafana: import the SkaiBridge dashboard into it, send it your metrics with OpenTelemetry export (Settings) or a Prometheus scrape (API key with Read metrics), and enter its address here, or paste a link to the dashboard itself (SkaiBridge takes the dashboard UID from the link). Links open the dashboard filtered to your organization, and to the host when opened from a host. Leave it empty to use SkaiBridge Grafana: it already has your metrics and needs no separate login. Set it to use both: the Grafana buttons then open your Grafana, and a SkaiBridge Grafana button appears beside them.
Sign in to your own Grafana with SkaiBridge
For Grafana Cloud or a Grafana you run yourself. People open it with their SkaiBridge sign-in (two-factor included) - no separate Grafana username or password - and get the Grafana role you choose for their SkaiBridge role. Add your Grafana here, then paste the settings shown into that Grafana once.
Event Archive & Purge
SIEM Streaming
Streams your organization's SkaiBridge records into your own SIEM as they happen - Splunk, Cribl, Microsoft Sentinel, Elastic, QRadar or any syslog receiver. Every record is normalized to OCSF (Open Cybersecurity Schema Framework) with Splunk CIM field names added, so it works with standard dashboards and correlation rules without custom parsing.
Two ways to connect. Push (destinations below, up to 5): SkaiBridge sends to a SIEM that is reachable from the internet, such as Splunk Cloud or Cribl Cloud. Pull (bottom of this panel): your SIEM fetches from SkaiBridge on a schedule over outbound HTTPS - the right choice for a SIEM inside your own network, with no inbound firewall rule.
Two ways to connect. Push (destinations below, up to 5): SkaiBridge sends to a SIEM that is reachable from the internet, such as Splunk Cloud or Cribl Cloud. Pull (bottom of this panel): your SIEM fetches from SkaiBridge on a schedule over outbound HTTPS - the right choice for a SIEM inside your own network, with no inbound firewall rule.
Receiver configuration example
Enabled (stream events here)
Pull from your SIEM
1. Create an API key with SIEM pull on the API Keys page. 2. Point your SIEM's REST collector at the address below with the header
Authorization: Bearer <key>. 3. Page with next_cursor while has_more is true, then poll every 1-5 minutes. Parameters: source, since, limit (up to 1000), min_severity, format=json|ndjson. At most 60 calls per minute per key.Cribl Stream REST Collector example
Script / scheduled job example (Splunk scripted input, QRadar, cron)
Preview the records SkaiBridge sends
Ticketing
By default, tickets for new detections go to SkaiBridge's own support desk. Choose your own ticketing platform here to route them into your instance instead. SkaiBridge opens, annotates, closes and re-opens tickets there. ServiceNow additionally syncs changes you make in ServiceNow (closing, re-opening, a note) back to the matching event.
Enabled (route new tickets here)