<aclass="skip-link"href="#overview">Skip to workspace</a><asidearia-label="Management navigation"><divclass="logo"><b>S</b><span>SafetyNet<small>Enterprise management</small></span></div><navaria-label="Workspace"><spanclass="nav-group">WORKSPACE</span><ahref="#overview">Overview</a><ahref="#devices">Device fleet</a><ahref="#events">Security events</a><ahref="#incidents">Incident triage</a><spanclass="nav-group">POLICY & PROTECTION</span><ahref="#policy">Browser policy</a><ahref="#user-profiles">User classes & website access</a><ahref="#policy-groups">Groups & pilot rollouts</a><ahref="#policy-history">Policy history</a><ahref="#policy-reviews">Independent approvals</a><ahref="#managed-settings">User permissions</a><ahref="#bookmarks">Company bookmarks</a><ahref="#teaching">Data protection & AI</a><ahref="#document-teaching">Document references</a><ahref="#diagnostics-controls">Browser diagnostics</a><ahref="#security-controls">Security rules & agents</a><ahref="#visual-protection">Visual impersonation</a><ahref="#clipboard-controls">Clipboard & ClickFix</a><ahref="#password-vault">Password vault</a><spanclass="nav-group">DEPLOYMENT</span><ahref="#enterprise-setup">Policy templates</a><ahref="#enterprise-integrations">Network & scanners</a><ahref="#access-sessions">Access & sessions</a></nav><divclass="aside-note"><labelfor="console-theme">Console appearance</label><selectid="console-theme"><optionvalue="system">Use system theme</option><optionvalue="light">Light</option><optionvalue="dark">Dark</option></select><spanclass="pill">Development build · 0.1</span></div></aside><main><header><div><pclass="eyebrow">SECURE ENTERPRISE BROWSING</p><h1>Management console</h1><pclass="header-description">Policies, people and protection in one workspace.</p></div><divclass="header-actions"><buttonid="refresh"class="secondary">Refresh workspace</button><buttonid="admin-logout"class="secondary"hidden>Sign out</button></div></header>
<sectionid="login"class="card"><h2>Administrator access</h2><p>Sign in with your enterprise identity, or use the bootstrap token configured on the server.</p><divclass="row"><inputid="token"type="password"placeholder="Bootstrap administrator token"autocomplete="off"><buttonid="connect">Connect</button><aclass="button secondary"href="/auth/login"id="sso">Enterprise SSO</a></div></section>
<pid="status"role="status"aria-live="polite"></p><pid="siem-status"class="muted"></p><divid="siem-controls"hidden><labelclass="checks"><inputid="siem-enabled"type="checkbox"> Enable security log export</label><buttonid="siem-save"class="secondary">Apply export setting</button><pclass="muted">Applies immediately to the management-service export. Security audit collection remains active. Delivery resumes from its durable cursor when enabled.</p><pid="siem-control-status"role="status"aria-live="polite"></p></div>
<divid="workspace"hidden><divclass="publish-bar"role="region"aria-label="Policy publication"><div><strongid="draft-state">Published policy loaded</strong><spanid="draft-detail">Changes stay in your draft until publication.</span></div><divclass="row"><buttonid="review-changes"class="secondary">Review draft changes</button><buttonid="publish-shortcut">Publish signed policy</button></div></div>
<sectionid="overview"class="metrics"><article><span>Enrolled devices</span><strongid="device-count">0</strong></article><article><span>Active policy</span><strongid="policy-version">v1</strong></article><article><span>Recent blocks</span><strongid="block-count">0</strong></article><article><span>AI workspace</span><strongid="ai-status">Off</strong></article></section><sectionclass="overview-grid"aria-label="Current policy posture"><articleclass="card"><pclass="eyebrow">POLICY POSTURE</p><h2>Current enforcement</h2><divid="policy-posture"></div><pclass="muted">Based on the published policy. Configuration is not a device health attestation.</p></article><articleclass="card"><pclass="eyebrow">OPERATOR WORKFLOW</p><h2>Configure, review, publish</h2><olclass="workflow"><li>Choose a template or adjust your controls.</li><li>Test data protection with representative examples.</li><li>Review changes and publish a signed policy.</li><li>Check device versions and security events.</li></ol><ahref="#enterprise-setup"class="button secondary">Configure a policy template</a></article></section><sectionclass="card"id="enterprise-setup"><pclass="eyebrow">ENTERPRISE SETUP</p><h2>Start with a reviewed policy template</h2><p>Templates tighten selected controls while keeping your existing rules and infrastructure. Preview changes, add them to your draft, then publish when ready.</p><divclass="row"><selectid="preset-id"><optionvalue="baseline">Enterprise baseline</option><optionvalue="managed-ai">Managed AI workspace</option><optionvalue="restricted">Restricted information</option><optionvalue="existing-stack">Preserve existing security stack</option></select><buttonid="preset-preview"class="secondary">Preview template</button><buttonid="preset-apply"disabled>Add preview to draft</button></div><pid="preset-description"></p><divid="preset-changes"></div><h3>Integration configuration</h3><p>These checks describe policy configuration. They do not certify that an enrolled device can reach the service.</p><divid="integration-readiness"></div></section>
<sectionclass="card"id="enterprise-integrations"><h2>Your existing network and security services</h2><p>Keep Windows-managed proxy and DNS for existing enterprise deployments, or mandate corporate resolvers and VPN interfaces. ICAP connects compatible antivirus and sandbox services before content is released.</p><divclass="grid"><label>DNS mode<selectid="enterprise-dns-mode"><optionvalue="system">Windows / VPN DNS</option><optionvalue="secure">Required corporate HTTPS DNS</option></select></label><label>Corporate HTTPS DNS resolvers <small>One HTTPS endpoint per line; clear when using Windows DNS</small><textareaid="enterprise-dns-templates"placeholder="https://dns.company.example/dns-query"></textarea></label><labelclass="checks"><inputtype="checkbox"id="enterprise-vpn-required"> Require corporate VPN interface</label><label>Approved Windows interface names <small>One exact adapter name per line</small><textareaid="enterprise-vpn-interfaces"placeholder="Company VPN"></textarea></label><label>Required VPN DNS server IPs <small>Optional; one IPv4 or IPv6 address per line</small><textareaid="enterprise-vpn-dns"placeholder="10.0.0.53"></textarea></label><labelclass="checks"><inputtype="checkbox"id="enterprise-icap-enabled"> Require external ICAP verdicts</label><buttontype="button"id="enterprise-icap-probe"class="secondary">Test ICAP capabilities</button><outputid="enterprise-icap-status"aria-live="polite"></output><label>ICAP service URL<inputid="enterprise-icap-url"placeholder="icaps://scanner.company.example:11344/avscan"></label><label>ICAP service method<selectid="enterprise-icap-method"><optionvalue="RESPMOD">Response modification service</option><optionvalue="REQMOD">Request modification service</option></select></label><label>Inspection timeout (milliseconds)<inputid="enterprise-icap-timeout"type="number"min="1000"max="60000"></label><label>Maximum inspection bytes<inputid="enterprise-icap-max"type="number"min="1024"max="20971520"></label></div><divclass="checks"><label><inputtype="checkbox"id="enterprise-icap-uploads"> Inspect uploads</label><label><inputtype="checkbox"id="enterprise-icap-downloads"> Inspect downloads</label><label><inputtype="checkbox"id="enterprise-icap-clipboard"> Inspect clipboard</label><label><inputtype="checkbox"id="enterprise-icap-ai"> Inspect AI requests</label><label><inputtype="checkbox"id="enterprise-icap-insecure"> Approve remote plaintext ICAP transport</label></div><pclass="muted">TLS certificate validation stays enabled. Customer CA certificates and mutual TLS credentials belong in protected deployment configuration. Plaintext ICAP exposes submitted content; approve it only for a separately protected trusted transport. VPN adapter checks do not prove tunnel routing. Deferred verdicts and modified payloads are rejected. Publish the signed policy to apply changes.</p></section>
<sectionid="policy"class="card"><divclass="section-head"><div><pclass="eyebrow">CENTRAL CONFIGURATION</p><h2>One policy. Every managed browser.</h2></div><spanclass="pill"id="identity"></span></div>
<divclass="checks"><label><inputid="downloads"type="checkbox"> Allow downloads</label><label><inputid="devtools"type="checkbox"> Allow developer tools</label><label><inputid="websockets"type="checkbox"> Allow WebSockets (messages not inspected)</label><label><inputid="ai-enabled"type="checkbox"> Enable approved AI gateway</label></div><buttonid="publish">Publish signed policy</button><pclass="muted">Devices refresh every 15 seconds. Changes and actor identity are recorded in the audit log.</p></section>
<sectionid="user-profiles"class="card"><pclass="eyebrow">IDENTITY AND FEATURE ACCESS</p><h2>User classes and website access</h2><p>Create profiles for any user class with your own names and controls. Employee, developer and high-protection templates are optional starting points. Assign profiles to verified enterprise subjects or explicit managed devices. Asset-owner labels are not authenticated identities. Website denials and category restrictions accumulate across matching profiles; an allowlist does not bypass a denial.</p><buttonid="profiles-refresh"class="secondary">Refresh profiles</button><pid="profiles-status"role="status"aria-live="polite"></p><divclass="table-wrap"><table><thead><tr><th>Profile</th><th>Assignments</th><th>Developer tools</th><th>Action</th></tr></thead><tbodyid="profiles-rows"></tbody></table></div><divclass="row"><buttonid="profile-new"class="secondary">Create your own profile</button><label>Starting class<selectid="profile-template"><optionvalue="employee">Employee</option><optionvalue="developer">Developer</option><optionvalue="high-protection">High protection</option></select></label><buttonid="profile-use-template"class="secondary">Use class in draft</button></div><h3id="profile-editor-title">Create profile</h3><divclass="grid"><label>Identifier<inputid="profile-id"maxlength="80"></label><label>Name<inputid="profile-name"maxlength="100"></label><label>Verified enterprise subject identifiers<textareaid="profile-subjects"placeholder="Exact issuer-verified subject; one per line"></textarea></label><fieldset><legend>Explicit device assignments</legend><divid="profile-devices"class="device-checklist"></div></fieldset><label>Allowed website hosts<textareaid="profile-allowed"placeholder="Empty adds no allowlist restriction"></textarea></label><label>Denied website hosts<textareaid="profile-blocked"placeholder="*.unapproved.example"></textarea></label><fieldset><legend>Denied domain categories</legend><divid="profile-categories"class="device-checklist"></div></fieldset><label>Developer tools / browser console<selectid="profile-devtools"><optionvalue="inherit">Inherit baseline</option><optionvalue="deny">Deny</option><optionvalue="allow">Allow within delegated baseline</option></select></label><label>Downloads<selectid="profile-downloads"><optionvalue="inherit">Inherit</option><optionvalue="deny">Deny</option></select></label><label>AI workspace<selectid="profile-ai"><optionvalue="inherit">Inherit</option><optionvalue="deny">Deny</option></select></label><label>Local agents<selectid="profile-agents"><optionvalue="inherit">Inherit</option><optionvalue="deny">Deny</option></select></label><labelclass="checks"><inputid="profile-scan"type="checkbox"> Require document analysis</label></div><pclass="muted">Developer grants require central delegation; any applicable deny wins. No profile can override mandatory scanning or unlock centrally hidden settings.</p><divclass="row"><buttonid="profile-save">Publish profile</button><buttonid="profile-delete"class="danger"disabled>Delete profile</button></div><h3>Preview effective device policy</h3><divclass="row"><selectid="profile-preview-device"aria-label="Preview device"></select><buttonid="profile-preview"class="secondary">Preview current draft</button></div><pid="profile-preview-summary"aria-live="polite"></p><divid="profile-preview-diff"></div><details><summary>Central categories and developer delegation</summary><p>Categories contain your approved domain lists. This is not an automatic external website reputation feed. Enabling delegation permits reviewed developer-profile grants; denying profiles still win.</p><labelclass="checks"><inputid="profile-delegation"type="checkbox"> Permit profiles to grant developer tools</label><h4>Website categories</h4><p>Use exact hosts or wildcard subdomains such as *.social.example. Changes stay in this local draft until explicit publication or independent approval.</p><buttonid="profile-category-add"class="secondary">Add website category</button><button
<sectionclass="card"id="bookmarks"><pclass="eyebrow">COMPANY LIBRARY</p><h2>Managed bookmarks</h2><p>Publish intranet and approved service links to every browser. Company bookmarks are read-only for employees. Personal bookmarks remain separate; configure whether employees may add, edit or delete them.</p><divclass="checks"><label><inputtype="checkbox"id="bookmarks-add"> Allow personal additions</label><label><inputtype="checkbox"id="bookmarks-edit"> Allow personal edits</label><label><inputtype="checkbox"id="bookmarks-delete"> Allow personal deletion</label><label><inputtype="checkbox"id="bookmarks-admin-read"> Allow administrators to read and edit personal bookmarks</label></div><fieldset><legend>AI library organization</legend><divclass="checks"><label><inputid="library-ai-enabled"type="checkbox"> Enable approved AI organization suggestions</label><label><inputid="library-ai-autoapply"type="checkbox"> Permit agent application without an additional user review</label></div><pclass="muted">Suggestions require the approved AI gateway and Library permissions. Agents also require the organization scopes below. Company bookmarks remain protected. Keep automatic application disabled to require explicit confirmation before changes.</p></fieldset><divclass="table-wrap"><table><thead><tr><th>Title</th><th>HTTPS / HTTP URL (no query or fragment)</th><th>Folder</th><th>Actions</th></tr></thead><tbodyid="managed-bookmark-rows"></tbody></table></div><buttonclass="secondary"id="managed-bookmark-add">Add company bookmark</button><pclass="muted">Company changes are drafts until you publish the signed policy. Personal permissions also respect the centrally locked or hidden Library section.</p><h3>Device personal bookmarks</h3><p>Authorized administrators can review and remotely edit a device's synchronized personal bookmarks. Changes are applied when the browser next refreshes management state. Titles and URLs are never included in security audit events.</p><divclass="row"><selectid="bookmark-device"aria-label="Device to review"></select><buttonid="bookmark-device-load"class="secondary">Read device bookmarks</button></div><pid="bookmark-device-status"role="status"aria-live="polite"></p><divid="bookmark-device-editor"hidden><divclass="table-wrap"><table><thead><tr><th>Title</th><th>HTTPS / HTTP URL (no query or fragment)</th><th>Folder</th><th>Actions</th></tr></thead><tbodyid="personal-bookmark-rows"></tbody></table></div><divclass="row"><buttonid="personal-bookmark-add"class="secondary">Add personal bookmark</button><buttonid="bookmark-device-save">Save remote changes</button><buttonid="bookmark-device-refresh"class="secondary">Discard edits and refresh</button></div><pclass="muted">Saving compares the loaded revision so another user's or administrator's updates cannot be overwritten silently.</p></div></section>
<sectionid="teaching"class="card"><pclass="eyebrow">TEACH YOUR BROWSER</p><h2>Define what must stay inside</h2><p>Add phrases that must never leave, or register an exact file fingerprint. Reference files stay on your computer; only their SHA-256 fingerprint enters policy.</p><divclass="row"><inputid="rule-label"placeholder="Rule name"><inputid="rule-value"placeholder="Confidential phrase"><buttonid="add-rule">Add phrase</button></div><labelclass="file">Register a confidential file fingerprint<inputid="fingerprint"type="file"></label><divid="rules"></div><divclass="grid"><labelclass="wide">Try a policy example<textareaid="test-text"placeholder="Test content is sent to your management server, never to an AI provider."></textarea></label></div><buttonid="test"class="secondary">Test draft policy</button><outputid="test-result"></output><h2>Local semantic reference protection</h2><p>Describe a confidential category. Your approved local EmbeddingGemma 2 runtime creates pinned text reference vectors. Document extraction and local OCR text can be compared against these references. This workflow does not train a model or provide native video inspection.</p><divclass="grid"><label>Category name<inputid="semantic-label"placeholder="Unreleased product designs"></label><label>Similarity threshold<inputid="semantic-threshold"type="number"min="0.000001"max="1"step="0.01"value="0.8"></label><labelclass="wide">Confidential category description<textareaid="semantic-description"placeholder="Describe the protected topic with representative examples."></textarea></label></div><buttonid="semantic-add"class="secondary">Create semantic reference</button><label>Internal semantic reference document (up to 1 MiB)<inputid="semantic-document"type="file"></label><buttonid="semantic-document-add"class="secondary">Derive local document reference</button><p>Only normalized reference vectors and coverage features enter the policy draft. No document, extracted text or model fine tuning is retained. Complete extraction and chunk coverage are required; publish explicitly to approve.</p><labelclass="checks"><inputid="semantic-enabled"type="checkbox"> Enforce semantic categories</label><divid="semantic-rules"></div><pclass="muted">Requires locally provisioned model weights, an exact model revision, matching dimensions and the document-v1 profile. Similarity is a detector score, not a confidence guarantee. Incomplete extraction or chunk coverage always blocks.</p></section>
<sectionclass="card"id="security-controls"><h2>Enterprise security and local agents</h2><p>Configure centrally signed DNS blocklists, YARA source rules, content phrases, restricted Sigma metadata detections and agent permissions. Unsupported Sigma syntax is rejected.</p><divclass="grid"><labelclass="checks"><inputid="security-dns-enabled"type="checkbox"> Enforce DNS blocklists</label><label>Blocked DNS hosts<textareaid="security-dns-hosts"placeholder="*.unapproved.example"></textarea></label><label>Blocked IP addresses<textareaid="security-dns-ips"placeholder="203.0.113.10"></textarea></label><label>Blocked content phrases<textareaid="security-content-phrases"placeholder="One phrase per line"></textarea></label><labelclass="checks"><inputid="security-yara-enabled"type="checkbox"> Require local YARA scanning</label><label>YARA maximum scanned bytes<inputid="security-yara-max"type="number"min="1024"max="20971520"></label><labelclass="checks"><inputid="agent-enabled"type="checkbox"> Enable paired local agents</label><label>Agent destination allowlist<textareaid="agent-hosts"placeholder="*.company.example"></textarea></label><labelclass="checks"><inputid="agent-sensitive"type="checkbox"> Permit sensitive page reads within approved scopes</label><fieldsetclass="wide"><legend>Agent capabilities</legend><divclass="checks"><label><inputid="agent-scope-sessions"type="checkbox"> Sessions</label><label><inputid="agent-scope-navigate"type="checkbox"> Navigate</label><label><inputid="agent-scope-back"type="checkbox"> History back</label><label><inputid="agent-scope-forward"type="checkbox"> History forward</label><label><inputid="agent-scope-reload"type="checkbox"> Reload page</label><label><inputid="agent-scope-read"type="checkbox"> Read</label><label><inputid="agent-scope-inspect"type="checkbox"> Inspect page controls and values</label><label><inputid="agent-scope-scroll"type="checkbox"> Scroll pages</label><label><inputid="agent-scope-click"type="checkbox"> Click</label><label><inputid="agent-scope-type"type="checkbox"> Type</label><label><inputid="agent-scope-select"type="checkbox"> Select approved form option</label><label><inputid="agent-scope-check"type="checkbox"> Set checkbox state</label><label><inputid="agent-scope-screenshot"type="checkbox"> Screenshot</label><label><inputid="agent-scope-ai"type="checkbox"> AI gateway</label><label><inputid="agent-scope-tabs:close"type="checkbox"> Close tabs</label><label><inputid="agent-scope-bookmarks:list"type="checkbox"> Read bookmarks</label><label><inputid="agent-scope-tabs:group"type="checkbox"> Group tabs</label><label><inputid="agent-scope-tabs:activate"type="checkbox"> Activate tabs</label><label><inputid="agent-scope-bookmarks:mutate"type="checkbox"> Organize user bookmarks</label><label><inputid="agent-scope-application:state"type="checkbox"> Application state</label><label><inputid="agent-scope-tabs:create"type="checkbox"> Create native tabs</label><label><inputid="agent-scope-settings:get"type="checkbox"> Read managed settings</label><label><inputid="agent-scope-settings:update"type="checkbox"> Change permitted appearance</label><label><inputid="agent-scope-library:organize-plan"type="checkbox"> Propose AI library organization</label><label><inputid="agent-scope-library:organize-apply"type="checkbox"> Apply approved library organization</label></div></fieldset><divclass="wide"id="agent-grants-controls"><h3>Individual agent identities</h3><label>Identity mode<selectid="agent-identity-mode"><optionvalue="legacy">Existing shared pairing (legacy)</option><optionvalue="individual">Individual agent grants only</option></select></label><p>Individual mode requires an enrolled local identity matching an enabled, unexpired grant. Grant scopes and destinations further restrict the central baseline. Credentials stay on the device; no private keys or tokens are stored here. Revocation and generation changes take effect after the new signed policy reaches the browser.</p><buttontype="button"id="agent-gra
<section class="card"id="document-teaching"><h2>Governed document teaching</h2><p>Submit a reference document to the private local inspector, then explicitly approve its fingerprint for publication. For incomplete extraction, explicitly approve available fingerprints with partial coverage; unextracted media is not fingerprinted. Only hashes, coverage counts and the reference label are retained. Full documents, extracted text and base64 are discarded after local processing and are never persisted by management.</p><divclass="row"><inputid="teach-label"placeholder="Confidential reference label"><inputid="teach-file"type="file"><buttonid="teach-submit">Create reviewed draft</button></div><divid="teach-drafts"></div></section><sectionclass="card"id="password-vault"><h2>Local password vault</h2><p>Credentials stay on the browser device. Management stores permissions and lifecycle audit events only; passwords, usernames and credential identifiers are not uploaded.</p><divclass="checks"><label><inputid="vault-enabled"type="checkbox"> Enable password vault</label><label><inputid="vault-saving"type="checkbox"> Allow saving credentials</label><label><inputid="vault-autofill"type="checkbox"> Allow autofill</label></div><label>Idle lock in seconds (60–900)<inputid="vault-idle"type="number"min="60"max="900"></label><p>Publish signed policy to apply these controls.</p></section><sectionclass="card"id="visual-protection"><h2>Visual impersonation protection</h2><labelclass="checks"><inputid="visual-enabled"type="checkbox"> Block protected login designs on unauthorized origins</label><p>For example, register a trusted Google login screenshot and allow only https://accounts.google.com. A matching login on another origin can then be blocked even when its domain is absent from every blocklist.</p><p>Upload your own trusted PNG of a brand login page or cropped login form. Only a derived perceptual hash, dimensions and allowed origins enter the policy draft. Reference pixels are discarded; no automatic Google or other brand profile is supplied.</p><divclass="grid"><label>Brand identifier<inputid="visual-id"maxlength="80"placeholder="corporate-login"></label><label>Brand label<inputid="visual-label"maxlength="100"placeholder="Corporate login"></label><labelclass="wide">Exact allowed HTTPS origins<textareaid="visual-origins"placeholder="https://login.company.example"></textarea></label><label>Reference scope<selectid="visual-scope"><optionvalue="viewport">Whole viewport</option><optionvalue="login-form">Cropped login form</option></select></label><label>Trusted PNG reference<inputid="visual-image"type="file"accept="image/png"></label></div><buttonid="visual-add">Derive reference into draft</button><p>Add trusted references, enable the control above and publish the signed policy. Use multiple references for different themes, languages and login steps. False positives, viewport changes and visual evasion require validation. The browser checks rendered pixels; this is not pre-render response inspection.</p></section><sectionclass="card"id="clipboard-controls"><h2>Managed clipboard and ClickFix protection</h2><p>Control supported browser copy, cut and paste actions centrally. High-risk shell command patterns are blocked without sending clipboard text to an AI provider. Clipboard text and credentials never enter security logs.</p><divclass="checks"><label><inputid="clipboard-enabled"type="checkbox"> Enable clipboard controls</label><label><inputid="clipboard-copy"type="checkbox"> Allow copy</label><label><inputid="clipboard-cut"type="checkbox"> Allow cut</label><label><inputid="clipboard-paste"type="checkbox"> Allow paste</label><label><inputid="clipboard-command"type="checkbox"> Block suspicious execution commands</label></div><label>Maximum clipboard text bytes<inputid="clipboard-max"type="number"min="1024"max="1048576"></label><p>Publish signed policy to apply. Mandatory DLP remains active when supplemental clipboard controls are disabled. Unsupported formats and unavailable required
<sectionid="access-sessions"class="card"><pclass="eyebrow">ADMINISTRATOR ACCESS</p><h2>Active management sessions</h2><p>Administrators can review current SSO sessions and immediately revoke a session. Identity-provider group membership controls whether that person can sign in again. Bootstrap access has no stored browser session.</p><buttonid="sessions-load"class="secondary">Refresh active sessions</button><pid="sessions-status"role="status"aria-live="polite">Session inventory requires the administrator role.</p><divclass="table-wrap"><table><thead><tr><th>Identity</th><th>Role</th><th>Expires</th><th>Action</th></tr></thead><tbodyid="session-rows"></tbody></table></div></section><sectionid="incidents"class="card"><pclass="eyebrow">SECURITY OPERATIONS</p><h2>Incident triage</h2><p>Review security event metadata, assign an investigation and record its outcome. Protected evidence is shown separately only with explicit, audited access. Keep investigation notes free of secrets and personal data.</p><divclass="row filter-row"><label>Status<selectid="incident-status-filter"><optionvalue="">All statuses</option><option>open</option><option>investigating</option><option>resolved</option><option>dismissed</option></select></label><label>Severity<selectid="incident-severity-filter"><optionvalue="">All severities</option><option>low</option><option>medium</option><option>high</option><option>critical</option></select></label><buttonid="incidents-refresh"class="secondary">Refresh incidents</button></div><pid="incidents-status"role="status"aria-live="polite"></p><divclass="table-wrap"><table><thead><tr><th>Created</th><th>Security event</th><th>Status</th><th>Severity</th><th>Assignee</th><th>Review</th></tr></thead><tbodyid="incident-rows"></tbody></table></div><buttonid="incidents-more"class="secondary"hidden>Load older incidents</button><divid="incident-detail"hidden><divclass="section-head"><h3id="incident-title">Incident</h3><buttonid="incident-detail-refresh"class="secondary">Discard edits and refresh</button></div><pid="incident-revision"class="muted"></p><preid="incident-event"></pre><sectionid="incident-evidence"class="evidence-viewer"hiddenaria-labelledby="evidence-title"><divclass="section-head"><h3id="evidence-title">Device-reported protected evidence</h3><buttonid="evidence-close"class="secondary">Close and clear</button></div><label>Access purpose<selectid="evidence-reason"><optionvalue="">Choose a purpose</option><optionvalue="incident-response">Incident response</option><optionvalue="investigation">Investigation</option><optionvalue="compliance">Compliance</option></select></label><divid="evidence-rows"></div><pid="evidence-status"role="status"aria-live="polite"></p><preid="evidence-plaintext"hidden></pre></section><divclass="grid"><label>Investigation status<selectid="incident-state"><option>open</option><option>investigating</option><option>resolved</option><option>dismissed</option></select></label><label>Severity<selectid="incident-severity"><option>low</option><option>medium</option><option>high</option><option>critical</option></select></label><label>Assignee<inputid="incident-assignee"maxlength="160"placeholder="Team or analyst identity"></label><labelclass="wide">Investigation note<textareaid="incident-comment"maxlength="1000"placeholder="Metadata and investigation outcome only; do not paste secrets."></textarea></label></div><buttonid="incident-save">Save investigation update</button><pid="incident-detail-status"role="status"aria-live="polite"></p><h3>Investigation history</h3><divid="incident-history"></div></div></section><sectionclass="card"id="audit-retention"><pclass="eyebrow">AUDIT LIFECYCLE</p><h2>Database event retention</h2><pid="audit-retention-status"role="status">Loading deployment configuration.</p><pclass="muted">Retention applies only to exported database events that are not referenced by incidents. Investigation history is retained. External SIEM, file exports and backups have separate retention policies. Deployment
<sectionclass="card"id="company-branding"><pclass="eyebrow">COMPANY EXPERIENCE</p><h2>Company logo and start page</h2><p>Roll out your company identity through signed policy. Name and accent above apply alongside this logo.</p><divclass="grid"><label>Company logo (PNG, up to 128 KiB)<inputid="brand-logo-file"type="file"accept="image/png"></label><div><imgid="brand-logo-preview"alt="Company logo preview"width="160"height="80"hidden><buttonid="brand-logo-remove"type="button"class="secondary">Remove logo</button><outputid="brand-logo-status"aria-live="polite"></output></div><label>Start-page heading<inputid="startpage-title"maxlength="100"placeholder="Welcome"></label><label>Start-page message<inputid="startpage-subtitle"maxlength="240"placeholder="Your company workspace"></label><label><inputid="startpage-news-enabled"type="checkbox"> Show company news</label><label>Company RSS / Atom feed (HTTPS)<inputid="startpage-feed-url"type="url"placeholder="https://intranet.company.example/news.xml"></label></div><p>Logo pixels are re-encoded locally; SVG is not accepted. News is retrieved by management only from deployment-approved feed hosts. Ask your server operator to allow the exact host. Feed URLs cannot contain credentials or fragments. Use server-configured authentication; do not put secrets in URLs. Publish and review these changes with your normal policy workflow.</p></section><sectionclass="card"id="download-scan-controls"><h2>Download inspection</h2><divclass="checks"><label><inputid="download-document-dlp"type="checkbox"> Require complete document DLP for incoming downloads</label><label><inputid="yara-office-macros"type="checkbox"> Scan extracted Office VBA with enabled central YARA rules</label></div><p>Document DLP is required by default. Disabling it permits incoming documents after every enabled malware scanner approves them; upload protection remains enforced. Without any antivirus scanner, complete document DLP is still mandatory. Office macros are not executed. Unreadable or unsupported macro extraction blocks when local macro scanning is enabled. ICAP remains mandatory whenever enabled.</p></section><sectionid="audit-integrity"class="card"hidden><pclass="eyebrow">AUDIT INTEGRITY</p><divclass="section-head"><h2>Verify security audit records</h2><buttonid="audit-integrity-verify"type="button"class="secondary">Verify stored records</button></div><p>Run an explicit consistency and signature check. This check is separate from OpenTelemetry traces and SIEM delivery.</p><pid="audit-integrity-status"class="muted"aria-live="polite">Not verified in this session.</p><divid="audit-integrity-details"style="overflow-wrap:anywhere"></div></section><sectionid="evidence-policy-controls"class="card"><pclass="eyebrow">PROTECTED SECURITY EVIDENCE</p><h2>Protected evidence collection</h2><p>Opt in through centrally signed policy. All collection controls are off by default. Ordinary security audit records and OpenTelemetry traces remain separate.</p><divclass="checks"><label><inputid="evidence-policy-enabled"type="checkbox"> Enable protected evidence recording</label><label><inputid="evidence-policy-downloads"type="checkbox"> Automatically capture inspected download metadata</label><label><inputid="evidence-policy-interactions"type="checkbox"> Capture clipboard, agent-click and observed page-gesture metadata</label></div><p>Download evidence contains the source URL without its query or fragment, filename, SHA-256, byte count, MIME type and verdict. It does not contain the file body or the OS save path. Passwords and recognizable authentication credentials are excluded. A deployment-protected evidence key is required before enabling recording.</p><p>Disabling recording prevents new device evidence writes and removes pending native evidence payloads; ordinary security events remain. Existing encrypted evidence retains its access and retention controls. Interaction capture records the website origin, session, action and bounded target metadata. Guarded clipboard and agent effec
