Live Tail Logs: Improve SOC visualization with country flags, enriched log details and consistent dashboard design #5

New Issue

2026-07-25T18:44:50Z

tech commented

2026-07-25 18:44:50 +00:00

Problem

The /logs/live-tail section currently does not match the rest of the ARGUS SOC dashboard experience.

The live log view needs better visual context and should follow the same design system used across the platform.

Current issues:

No country flag displayed for source IP location.
Logs contain limited contextual information.
Visual design differs from Analytics and Security sections.
Charts, typography and components are inconsistent with the rest of ARGUS.

Expected behavior

The Live Tail page should become a full SOC-style event monitoring interface.

Country information

Every log entry with GeoIP information should display:

Country flag
Country name
Country code

Example:
🇨🇳 China (CN)
185.xxx.xxx.xxx

Use the existing GeoIP country code information.

Do not identify countries by name parsing.

Use ISO 3166-1 alpha-2 codes for flag rendering.

Enriched log information

Each live event should provide more security context.

Example:

Time:
17:42:31

Source:
🇷🇺 Russia
185.xxx.xxx.xxx

Request:
GET /wp-login.php

Status:
403 Forbidden

Security:
WAF Block

Rule:
OWASP CRS 942100

Threat:
SQL Injection Attempt

User Agent:
curl/8.x

Reputation:
Malicious IP

The operator should be able to understand the event without opening multiple pages.

Log row design

Redesign log entries using the same ARGUS SOC style.

Include:

Severity indicator
Country flag
Source IP
HTTP method
URI/path
Status code
Action taken
Rule triggered
Timestamp

Example:

🔴 HIGH 🇨🇳 China 45.xxx.xxx.xxx

GET /admin/login

403 BLOCKED

OWASP CRS 932160

2 seconds ago

Charts and visualization

The Live Tail page should use the same:

fonts
typography
spacing
cards
charts
colors
components

as:

/analytics/traffic
/analytics/geoip
/security/*
/dashboard

Do not create a separate visual style.

Add security summary widgets

At the top of Live Tail consider adding:

Live Events

Requests/sec
Blocked
Allowed
Critical Events
Top Countries
Top Attack Types

with real-time charts.

Real-time behavior

Maintain live streaming functionality.

Requirements:

no full page refresh
smooth event updates
efficient rendering with large event volumes
pause/resume live feed option
search/filter without stopping the stream

Backend/API review

Verify live logs provide enough information:

Required fields:

{
  "timestamp": "",
  "source_ip": "",
  "country_code": "",
  "country_name": "",
  "method": "",
  "uri": "",
  "status_code": 403,
  "action": "blocked",
  "severity": "high",
  "rule_id": "",
  "user_agent": "",
  "threat_score": ""
}

If information already exists, only improve the frontend.

Goal

The Live Tail page should feel like a professional SOC monitoring console, allowing security operators to identify attacks immediately without leaving the page.

The design must be consistent with the rest of ARGUS Enterprise.


Labels:

```text
component:logs
component:soc-dashboard
type:enhancement
priority:high

## Problem The /logs/live-tail section currently does not match the rest of the ARGUS SOC dashboard experience. The live log view needs better visual context and should follow the same design system used across the platform. Current issues: - No country flag displayed for source IP location. - Logs contain limited contextual information. - Visual design differs from Analytics and Security sections. - Charts, typography and components are inconsistent with the rest of ARGUS. ## Expected behavior The Live Tail page should become a full SOC-style event monitoring interface. --- ## Country information Every log entry with GeoIP information should display: - Country flag - Country name - Country code Example: 🇨🇳 China (CN) 185.xxx.xxx.xxx Use the existing GeoIP country code information. Do not identify countries by name parsing. Use ISO 3166-1 alpha-2 codes for flag rendering. --- ## Enriched log information Each live event should provide more security context. Example: Time: 17:42:31 Source: 🇷🇺 Russia 185.xxx.xxx.xxx Request: GET /wp-login.php Status: 403 Forbidden Security: WAF Block Rule: OWASP CRS 942100 Threat: SQL Injection Attempt User Agent: curl/8.x Reputation: Malicious IP The operator should be able to understand the event without opening multiple pages. --- ## Log row design Redesign log entries using the same ARGUS SOC style. Include: - Severity indicator - Country flag - Source IP - HTTP method - URI/path - Status code - Action taken - Rule triggered - Timestamp Example: 🔴 HIGH 🇨🇳 China 45.xxx.xxx.xxx GET /admin/login 403 BLOCKED OWASP CRS 932160 2 seconds ago --- ## Charts and visualization The Live Tail page should use the same: - fonts - typography - spacing - cards - charts - colors - components as: - /analytics/traffic - /analytics/geoip - /security/* - /dashboard Do not create a separate visual style. --- ## Add security summary widgets At the top of Live Tail consider adding: Live Events Requests/sec Blocked Allowed Critical Events Top Countries Top Attack Types with real-time charts. --- ## Real-time behavior Maintain live streaming functionality. Requirements: - no full page refresh - smooth event updates - efficient rendering with large event volumes - pause/resume live feed option - search/filter without stopping the stream --- ## Backend/API review Verify live logs provide enough information: Required fields: ```json { "timestamp": "", "source_ip": "", "country_code": "", "country_name": "", "method": "", "uri": "", "status_code": 403, "action": "blocked", "severity": "high", "rule_id": "", "user_agent": "", "threat_score": "" } If information already exists, only improve the frontend. Goal The Live Tail page should feel like a professional SOC monitoring console, allowing security operators to identify attacks immediately without leaving the page. The design must be consistent with the rest of ARGUS Enterprise. Labels: ```text component:logs component:soc-dashboard type:enhancement priority:high

tech commented

2026-07-25 19:38:02 +00:00

Moved to the correct repository: weboria/argus-appliance#6. argus-installer only tracks customer installer/deployment issues; this is a product feature, so tracking continues there (a private repo). Closing here.

tech closed this issue

2026-07-25 19:38:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Weboria/argus-installer#5