Console guide

Sign in and choose your organization

Sign in to open the Console. Tools and data use the active organization and its effective plan. If you belong to more than one organization, select the intended workspace in Overview before inspecting usage or managing keys.

Owners, admins and members can view workspace tools, subject to the plan gates below. Owners and admins manage API keys, membership, billing and the integration allowlist. Activity is restricted to owners and admins. Being an admin does not bypass a plan restriction.

Overview

Overview shows the access plan, active keys, team size and API usage. Paid workspaces also show daily request and row usage. Start here to check the active organization and find the first-call instructions.

Events

Events lets Professional and Enterprise members filter observations by window, protocol, region, actor and category. Open individual observations and actor history for more context. CSV and JSON downloads contain up to 5,000 rows per download. Public and Researcher workspaces see a small public sample preview and an upgrade link. Professional data is delayed 15 minutes with 30-day history; Enterprise has no minimum delay and up to 365-day history. Available history begins with collection, not subscription purchase.

Lookup

Lookup accepts public IP addresses and ASNs. Public and Researcher organizations receive five lookups per UTC day showing verdict and last seen day. Professional and Enterprise unlock confidence, evidence, suggested action and up to 30 days of history. Not seen means unknown, never safe. Follow the triage guide.

Blocklist

Blocklist shows broad and high-confidence counts. Professional and Enterprise unlock dictionary values, search, leaked-only filtering and txt, JSON and Entra ID downloads. Credential Intelligence beta is included with Professional during beta. A planned $149/month add-on is not a currently available purchase. See password policy setup.

Integrations

Integrations shows the firewall feed URL, current entries and organization allowlist. Feed access needs an organization-bound Professional or Enterprise events key. Owners and admins can save the allowlist. Use the firewall guide or SIEM guide for setup.

API keys and Members

API keys lists keys and their usage. Owners and admins create, rotate and revoke keys. Copy a new secret when shown; rotation replaces the old key. Update each collector after rotation. Public organizations can have three active keys; other plans can have ten.

Members lists teammates and invitations. Owners and admins can invite, change roles and remove eligible members. The member controls do not change the owner or your own role. Use the intended email address when accepting an invitation.

Billing

Billing shows the plan and subscription status. Owners and admins manage checkout and the Stripe customer portal, including payment details, invoices, interval changes and cancellation. Access updates after payment confirmation; returning from checkout alone is not confirmation.

Professional costs $299/month or $2,990/year. The first 50 organizations can receive $199/month or $1,990/year, retained while subscribed. Enterprise starts at $12,000/year. Prices include tax. Monthly payments and renewals are non-refundable; the first annual payment is refundable in full when requested within 14 days. An organization owner should contact support for a refund; refunds are handled by the operator, not a Console button. Cancellation and refund are separate actions.

Notifications and Activity

Notifications controls your weekly email preference across organizations. Monday digests cover the previous ISO week in UTC. Free access receives public aggregates; paid digests include observed activity, CVEs, blocklist changes and organization API usage.

Activity lets owners and admins review organization audit actions. It is a workspace administration record, not an event collection feed. Use FAQ for access errors, billing questions and data limitations.