Analytics Overview: Redesign dashboard with richer security metrics, analytics and SOC-level visualizations #8

New Issue

2026-07-25T18:50:24Z

tech commented

2026-07-25 18:50:24 +00:00

Problem

The current /analytics/overview page provides only basic statistics and does not provide enough operational visibility for an enterprise security platform.

Current information:

Total Requests
Blocked Requests
Error Rate
Average Response Time
DNS Threats
Requests over time
Activity heatmap
Basic WAF/Bot/DNS/Geo counters

The page feels like a basic traffic dashboard and does not provide enough information for security operators.

ARGUS should provide a complete Security Analytics Overview similar to a SOC dashboard.

Goal

Redesign /analytics/overview into an enterprise security analytics dashboard.

The operator should immediately understand:

traffic volume
security events
attack trends
protection effectiveness
performance impact
geographic threats
top attack sources
most targeted services

New Dashboard Structure

1. Executive Security Summary Cards

Replace the current basic cards with richer security metrics.

Example:
Security Overview

Total Requests

231,540

Blocked Threats

12,430

Protection Rate

5.3%

Critical Events

24

Active Attackers

184

Countries Detected

72

Average Response

128ms

System Health

Healthy

Each card should include:

current value
trend compared with previous period
percentage change
status indicator

Example:

Blocked Threats

12,430

↑ 18% compared to yesterday

2. Traffic Analysis

Improve:

Requests over time — allowed vs blocked

Current chart is too simple.

Replace with interactive multi-series chart:

Show:

total requests
allowed requests
blocked requests
challenged requests
errors

Time ranges:

Last hour
24 hours
7 days
30 days

Example:

Traffic Activity

Requests
|
| /
| /\ /
|/ / __

Allowed
Blocked
Challenge
Errors

3. Security Events Timeline

Add a real-time security event chart.

Example:

Security Events

WAF Blocks ███████
Bot Detection ████
Rate Limits ██
DNS Threats █
ANIS Blocks █████

Show:

WAF events
bot detections
rate-limit actions
DNS threats
intelligence blocks

4. Attack Distribution

Add charts:

Threat Categories

Donut chart:

Attack Types

SQL Injection 35%
Bots 25%
Scanning 20%
XSS 10%
Other 10%

Action Distribution

Donut chart:

Security Actions

Blocked
Allowed
Challenge
Monitored

5. Top Security Sources

Add tables:

Top Attacking IPs

IP Address Country Events Risk

185.xxx.xxx.xxx 🇨🇳 China 5420 High
91.xxx.xxx.xxx 🇷🇺 Russia 2310 Medium

Top Source Countries

Include:

country flag
country
requests
blocked
reputation

Example:

🇨🇳 China

Requests:
20,400

Blocked:
18,900

Risk:
High

6. Target Analysis

Add:

Most Targeted Hosts

Host Requests Blocks

login.example.com 52,300 8,400
api.example.com 31,200 2,100

Most Targeted URLs

Path Events

/wp-login.php 4300
/admin 2200
/api/login 1500

7. Performance Analytics

Current:

Avg Response
0 ms

is insufficient.

Add:

average response time
p95 latency
p99 latency
upstream response time
slowest requests

Example:

Performance

Average:
128ms

P95:
420ms

P99:
890ms

8. Security Heatmap Improvements

Current heatmap only shows:

"Activity heatmap — by hour and day of week"

Improve it.

Allow switching:

View:

Traffic Volume
Security Events
Blocked Requests
Attack Activity

Example:

Monday ███████
Tuesday ████
Wednesday █████████

9. DNS Security Analytics

Expand DNS section:

Current:

DNS Threats
0

Add:

DNS Security

Threats detected:
120

DGA domains:
20

DNS tunneling:
5

Blocked domains:
95

10. ANIS Intelligence Integration

Include threat intelligence impact.

Example:

ANIS Intelligence

Known malicious IPs blocked:

2,430

Threat reputation lookups:

18,200

High confidence threats:

340

Last sync:

3 minutes ago

Link to:

/security/intelligence

11. Export and Reporting

Improve CSV/export.

Add:

date range selector
export analytics report
scheduled reports (future)

Design Requirements

The redesigned page must follow ARGUS SOC design:

same fonts
same cards
same charts
same spacing
responsive layout
dark enterprise security dashboard style

Avoid:

empty panels
basic counters without context
excessive scrolling

Use:

charts
visual indicators
trends
drill-down links

Backend/API Review

Review analytics APIs.

The frontend should not calculate everything from raw logs.

Required API data:

traffic statistics
security events
WAF statistics
bot statistics
DNS statistics
GeoIP statistics
ANIS statistics
performance metrics
top attackers
top targets

Add new endpoints if required:

GET /api/v1/analytics/overview

GET /api/v1/analytics/security-events

GET /api/v1/analytics/top-attackers

GET /api/v1/analytics/performance

GET /api/v1/analytics/threat-distribution

Final Goal

The /analytics/overview page should become the main SOC overview screen.

A security operator should open this page and immediately understand:

Is ARGUS under attack?
What is being blocked?
Where are attacks coming from?
Which applications are targeted?
Is performance affected?
What intelligence is contributing to protection?

The current page should be redesigned into a complete enterprise security analytics dashboard.

Labels:

component:analytics
component:soc-dashboard
type:enhancement
priority:high

## Problem The current /analytics/overview page provides only basic statistics and does not provide enough operational visibility for an enterprise security platform. Current information: - Total Requests - Blocked Requests - Error Rate - Average Response Time - DNS Threats - Requests over time - Activity heatmap - Basic WAF/Bot/DNS/Geo counters The page feels like a basic traffic dashboard and does not provide enough information for security operators. ARGUS should provide a complete Security Analytics Overview similar to a SOC dashboard. --- # Goal Redesign /analytics/overview into an enterprise security analytics dashboard. The operator should immediately understand: - traffic volume - security events - attack trends - protection effectiveness - performance impact - geographic threats - top attack sources - most targeted services --- # New Dashboard Structure ## 1. Executive Security Summary Cards Replace the current basic cards with richer security metrics. Example: Security Overview Total Requests 231,540 Blocked Threats 12,430 Protection Rate 5.3% Critical Events 24 Active Attackers 184 Countries Detected 72 Average Response 128ms System Health Healthy Each card should include: - current value - trend compared with previous period - percentage change - status indicator Example: Blocked Threats 12,430 ↑ 18% compared to yesterday --- # 2. Traffic Analysis Improve: Requests over time — allowed vs blocked Current chart is too simple. Replace with interactive multi-series chart: Show: - total requests - allowed requests - blocked requests - challenged requests - errors Time ranges: - Last hour - 24 hours - 7 days - 30 days Example: Traffic Activity Requests | | /\ | /\ / |/ / __ Allowed Blocked Challenge Errors --- # 3. Security Events Timeline Add a real-time security event chart. Example: Security Events WAF Blocks ███████ Bot Detection ████ Rate Limits ██ DNS Threats █ ANIS Blocks █████ Show: - WAF events - bot detections - rate-limit actions - DNS threats - intelligence blocks --- # 4. Attack Distribution Add charts: ## Threat Categories Donut chart: Attack Types SQL Injection 35% Bots 25% Scanning 20% XSS 10% Other 10% --- ## Action Distribution Donut chart: Security Actions Blocked Allowed Challenge Monitored --- # 5. Top Security Sources Add tables: ## Top Attacking IPs IP Address Country Events Risk 185.xxx.xxx.xxx 🇨🇳 China 5420 High 91.xxx.xxx.xxx 🇷🇺 Russia 2310 Medium ## Top Source Countries Include: - country flag - country - requests - blocked - reputation Example: 🇨🇳 China Requests: 20,400 Blocked: 18,900 Risk: High --- # 6. Target Analysis Add: ## Most Targeted Hosts Host Requests Blocks login.example.com 52,300 8,400 api.example.com 31,200 2,100 ## Most Targeted URLs Path Events /wp-login.php 4300 /admin 2200 /api/login 1500 --- # 7. Performance Analytics Current: Avg Response 0 ms is insufficient. Add: - average response time - p95 latency - p99 latency - upstream response time - slowest requests Example: Performance Average: 128ms P95: 420ms P99: 890ms --- # 8. Security Heatmap Improvements Current heatmap only shows: "Activity heatmap — by hour and day of week" Improve it. Allow switching: View: Traffic Volume Security Events Blocked Requests Attack Activity Example: Monday ███████ Tuesday ████ Wednesday █████████ --- # 9. DNS Security Analytics Expand DNS section: Current: DNS Threats 0 Add: DNS Security Threats detected: 120 DGA domains: 20 DNS tunneling: 5 Blocked domains: 95 --- # 10. ANIS Intelligence Integration Include threat intelligence impact. Example: ANIS Intelligence Known malicious IPs blocked: 2,430 Threat reputation lookups: 18,200 High confidence threats: 340 Last sync: 3 minutes ago Link to: /security/intelligence --- # 11. Export and Reporting Improve CSV/export. Add: - date range selector - export analytics report - scheduled reports (future) --- # Design Requirements The redesigned page must follow ARGUS SOC design: - same fonts - same cards - same charts - same spacing - responsive layout - dark enterprise security dashboard style Avoid: - empty panels - basic counters without context - excessive scrolling Use: - charts - visual indicators - trends - drill-down links --- # Backend/API Review Review analytics APIs. The frontend should not calculate everything from raw logs. Required API data: traffic statistics security events WAF statistics bot statistics DNS statistics GeoIP statistics ANIS statistics performance metrics top attackers top targets Add new endpoints if required: GET /api/v1/analytics/overview GET /api/v1/analytics/security-events GET /api/v1/analytics/top-attackers GET /api/v1/analytics/performance GET /api/v1/analytics/threat-distribution --- # Final Goal The /analytics/overview page should become the main SOC overview screen. A security operator should open this page and immediately understand: - Is ARGUS under attack? - What is being blocked? - Where are attacks coming from? - Which applications are targeted? - Is performance affected? - What intelligence is contributing to protection? The current page should be redesigned into a complete enterprise security analytics dashboard. Labels: component:analytics component:soc-dashboard type:enhancement priority:high

tech commented

2026-07-25 19:38:13 +00:00

Moved to the correct repository: weboria/argus-appliance#9. argus-installer only tracks customer installer/deployment issues; this is a product feature, so tracking continues there (a private repo). Closing here.

tech closed this issue

2026-07-25 19:38:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Weboria/argus-installer#8