Reading the overview screen
Four numbers and one banner. Which one means do something today, which are informational, and why an empty panel is not the same as a clean bill of health.
This is the screen you land on every day, and it carries four figures across the top and one banner underneath. Of the five, exactly one is the number that means you should do something today: Waiting on you. The rest are context for that one number, and reading them in the wrong order is the most common way to either panic over nothing or miss the thing that actually needs a decision.
The four tiles, in the order that matters
| Tile | What it counts | What it does not mean |
|---|---|---|
| Waiting on you | Approvals and escalations that need a decision from a person, right now. | Zero here does not mean nothing happened — only that nothing needs you specifically. |
| Handled automatically | Things Sentinel-Q resolved without needing your approval. | A high number here is not automatically good news; it is a count, not a verdict on severity. |
| Signals seen | Everything your connected sources reported, with a sub-line naming how many were high or critical. | This is not the same as "attacks" — most signals are routine and expected. |
| Sources connected | How many of your total sources are actually reporting, as connected of total. | Anything not connected is not merely quiet — it is genuinely unseen, and the screen says so directly. |
"Waiting on you" is the one to act on
The banner names exactly what is queued — actions waiting for your approval, or decisions Sentinel-Q passed to you because it was not confident enough to act alone — and gives you a button straight to the right queue: Review approvals or Review decisions. This is the same escalation surface covered in Agree, disagree or escalate; the overview screen is simply where you notice it exists.
When this queue is genuinely empty, the banner reads Nothing is waiting on you — and, deliberately, adds a second line: that is not the same as being secure. It means nothing we can see has raised anything that needs a decision from you. Treat those two sentences as one unit. The second exists because an empty queue and a well-defended organisation are not the same claim, and this product does not make the second claim on the strength of the first.
Empty means unseen, not clean
This is the single most important habit to build from this screen: a quiet panel is not evidence of safety if the coverage behind it is thin. Sources connected tells you how much of your estate is actually reporting; the overview screen pairs a quiet alert feed with a line stating how many of your sources are connected, precisely so a business with three of twelve sources wired up does not read silence as reassurance. If nothing is connected at all, every panel says nothing is connected, so nothing can report rather than pretending an empty feed is a clean one.
The three panels underneath
- Alerts
- The live alert feed. Empty and nothing connected reads differently from empty with sources connected — the panel names which case you are in.
- Sentinel-Q decisions
- What the AI investigated. It stays quiet until a connected source reports something worth investigating — it does not watch anything on its own.
- Waiting on you
- The approval queue itself, in list form beneath the summary tile above it.
What to do next
- Check Waiting on you first, every time you open the console, before you look at anything else on this screen.
- If Sources connected shows fewer than your total, treat that as the actual to-do — an unconnected source is a blind spot, not a quiet one.
- Read Alert severity and triage for what to do once you open a specific item from one of the panels.
- If you are new to the product, start with The Getting started checklist rather than this screen — it is built for the very first visit, and this one is built for every visit after.