# Spectra Detect Dashboard — Manager UI, Navigation, and Status Indicators

> Navigate the Spectra Detect Manager dashboard: monitor quota usage, view appliance status, access detections overview, and manage notifications from the global header.

This short introductory section is intended to help with understanding the basic layout of the user interface, terminology and visual indicators that are used on the Manager and in the rest of this User Guide.

## Global Header Bar

At the top of the Manager interface is the global header bar, containing the most commonly used options and the main appliance menu used to access all sections of the Manager.

- **Quota**: Usage-based quota insights for all Spectra Intelligence accounts used by the connected appliances. Clicking the triangle icon expands the header and displays the limit and the license renewal dates for each account. Quota limit statuses are color indicated. Additionally, this menu contains the option to contact ReversingLabs Support.

- **Dashboard**: The dashboard displays statistics related to the amount and type of files that have been submitted and processed on the appliance within a specified time range.

- **Central Configuration**: The [Central Configuration Manager](../Config/ApplianceConfiguration.md) allows users to modify configuration settings on Spectra Detect appliances directly from the Manager interface. The Central Configuration feature makes it easier to configure appliances remotely, and to ensure that the settings are consistent and correct across multiple appliances. The appliances must first be connected and authorized on the Manager instance. **Spectra Analyze appliances can be configured using the Spectra Detect Manager APIs.**

- **Administration**: Allows users to access and configure [Spectra Detect Manager Settings](../Admin/ManagerSettings.md), [YARA Synchronization](../Config/YARASync.md), [Redundancy](../Config/Redundancy.md), and [Email Alerting](../Admin/EmailAlerting.md).

- **Help**: Contains an option to access Manager API Documentation and the online product documentation.

- **Notifications**: Contains a bell icon that shows unread notifications for cloud classification changes. Clicking the `See all notifications` redirects users to the [Notifications](../Config/Notifications.md) page, where they can view and manage all notifications.

- **User menu**: Shows the username of the current user, contains link to user details, and the option to Log Out from the appliance.

- **Integrations Status Indicators**: Contains arrow labels providing information on which file input sources and file/report output sources are currently configured on the connected Hub groups.

## Integrations Indicators

The **Integrations Indicators** at the top-right of the interface contain `File Ingress Connectors` and `File Egress Connectors` providing information on which file input sources ([Connectors](../Config/AnalysisInput.md)) and file/report output sources ([Egress Integrations](../Config/ApplianceConfiguration.md#egress-integrations)) are currently configured on the connected Hub groups. Green icons indicate that the item has an existing configuration, not necessarily that the configuration is correct, and the service is connected, whereas grey icons indicate that the item does not have an existing configuration. Hub groups with configured Connectors are listed below the Connector, and outside of parentheses.

## Central Logging

The Manager dashboard has two modes: central logging *enabled*/*disabled*. If central logging is enabled (*Administration > Spectra Detect Manager > Central Logging*), users can access the **Analytics** tab which shows various statistics for the processed files before showing appliance status. If it's not enabled, the default tab is **Appliance Management** showing the status of the Manager and all connected appliances.

When central logging is enabled, the Analytics tab on the dashboard shows a detailed breakdown of analyzed files according to classification state, file type, malware family, the total size of all processed files, and more.

This classification data and error logs can be exported to CSV by clicking the `Export Classification Data` button at the top of the page.

Note that some processed files in these .csv files appear with slightly changed names, e.g. `-` become `[-]`. This is a measure to ensure sanitized input.

![](../images/c1000-dashboard-logging.png)

Exported classification data CSV files contain the following information: sample (container), classification, rca_factor,	malware_platform,	malware_type, malware_family,	filename, file_size (bytes), file_type_group, file_type, file_subtype, identification, processed_at, hostname.

## Detections Overview

The Detections Overview table is a list of files analyzed on connected Workers. It updates in 15 second intervals, and shows sample classification, file name, size, file type, threat name, scan date, AV detections, SHA1 and SHA256 hashes, source, source tag, and detailed analysis. All columns, apart from File, can be enabled or disabled using the gear icon menu in the top right of the table section.

The table can be sorted by clicking the column headers, and filtered using the `Show Table Filters` button which reveals text field filters above the table columns. Results can additionally be filtered by the time they were analyzed using the drop-down menu at the top of the table.

Clicking the `Showing LIVE Results` button stops the table from automatically updating, which can be useful while inspecting a specific set of results. Automatic updating is also paused when the user navigates from the first page of results.

Cloud analysis results do not affect the dashboard classification. However, if a newer cloud classification differs from the existing dashboard classification, a red indicator is displayed in the *Classification* column to signal that reprocessing is recommended.

The *AV Detections* column in the Detections Overview table displays results from the Deep Cloud Analysis (Multi-Scanning) Service, combining Worker Static Analysis and Spectra Intelligence analysis. It can be expanded to show the names of AV scanners and any detected threats, reflecting the analysis conducted by the Spectra Intelligence, where files are sent to AV scanners in the Cloud, with the results then exposed on the Manager dashboard.

To enable the Deep Cloud Analysis (Multi-Scanning) Service, navigate to *Administration > Spectra Detect Manager > Dashboard Configuration*, and select the `Enable Multi-Scanning` checkbox. When the Multi-Scanning is enabled, Workers upload samples to the Cloud only if the sample does not already exist in the Cloud, and passes the filtering criteria: up to 2GB in size. If the sample already exists in the Cloud, the Manager will monitor for any changes in the data and update the Manager dashboard accordingly. Read more details in the Multi-Scanning section of the [Spectra Detect Manager Settings](../Admin/ManagerSettings.md) chapter.

The `RESCAN` button sends a request to the Cloud to check for any updates associated with the submitted samples, and updates the information accordingly.

The `See All Scans` button opens a new page with all available Spectra Intelligence and AV Detections information.

### Product integration with Spectra Analyze

The `Detailed Analysis` column in the Detections Overview table allows the users to import the sample analyzed on the Spectra Detect platform into Spectra Analyze for a deeper insight into the analyzed file. For easier filtering, files imported to the Spectra Analyze appliance using this feature will automatically be tagged with the `spectra_detect` tag.

For this integration to be enabled, the Manager must be connected to at least one instance of Spectra Analyze 8.1 or higher, and central logging (*Administration > Spectra Detect Manager > Dashboard Configuration > Central Logging*) must be enabled. In addition, the sample must be stored either in an S3 bucket or on the Manager itself (Central Storage). If both of these features are enabled, Manager central storage takes priority (Spectra Analyze will download files from the Manager).

When Spectra Analyze integration is enabled and files are uploaded, the Sample Details link is available in the `Detailed Analysis` column, allowing users to directly open the file analysis page on the configured Spectra Analyze instance. This link remains available for the same files even after disabling the integration and takes priority over the Central File Storage and AWS S3 import links when multiple options are enabled.

## Processing Timeline

The Processing Timeline section of the dashboard shows a graph of uploaded, processed and post-processed samples, and also the number of samples that failed to analyze.

To retrieve a list of files that failed to analyze on the connected Spectra Detect appliances in the last 90 days, use the `Export Errors / Hashes` button.

The exported CSV file contains the following information: 

- `host_uuid`
- `hostname`
- `time`
- `event_type` 
- `task_id`
- `sample`
- `container`

The `host_uuid` value is set automatically when the Worker connects to the Manager, and obtainable using the `conf_centralmanager` command on the Worker.

Note that exported error logs might contain double entries for some errors. For example, if a file processing task fails, causing a failed report upload to S3, this is counted as two errors, despite being one event.

## Malware Types / Malware Family Count

The Malware Types and Malware Family Count charts show the analyzed samples categorized by Malware Type and Malware Family Count, respectively. Malware Type is presented as a percentage in a pie chart while Malware Families are displayed as a bar chart indicating the sample count per family.

## Appliance Management

![](../images/c1000-dashboard.png)

System information about the Manager instance and connected appliances can be found on the **Appliance Management** tab and is updated every 5 minutes. The *Status* column indicates whether the appliance is online, offline, unlicensed, in error state, or unauthorized. If YARA ruleset synchronization is enabled (*Administration > Spectra Detect Manager > General*) and on at least one connected appliance that supports it, a *YARA* column will show the current YARA ruleset synchronization status for each appliance. Possible YARA synchronization statuses are *In Sync*, *Not In Sync*, *Unknown*, *Please Update* and *Please Set To HTTPS*. See the [YARA Synchronization](../Config/YARASync.md) section for more details.

The Appliance Management page can be configured to display up to 100 appliances per page, and also filtered using the `Show Table Filters` button at the top of the list. This displays filter input fields in a row above the appliances table. Each table column has its own filter input field, allowing simultaneous filtering by multiple criteria.

Keep in mind that some actions (like configuration changes) will result in a system restart. Depending on the type of appliance, the process of restarting and reloading the configuration might take some time. Spectra Detect Worker appliances generally take longer to restart.

The following table describes common management actions and their consequences.

| ACTION                                         | APPLIANCE RESTART | MANAGER RESTART |
|------------------------------------------------|-------------------|------------------|
| Update the Manager instance                    | NO                | YES              |
| Modify settings on the Manager instance        | NO                | YES              |
| Connect an appliance to the Manager            | NO                | NO               |
| Authorize an appliance                         | NO                | NO               |
| Update a connected appliance                   | YES               | NO               |
| Modify settings on the Appliance Status page   | YES               | NO               |
| Disconnect an appliance from the Manager       | NO                | NO               |

## Connecting Appliances to the Manager

**Note: Adding the same appliance to multiple Managers is not supported. It can lead to misconfigurations and conflicts. Always remove the appliance from one Manager before adding it to another.**


To add an appliance, click `Add new appliance` on the Appliance Management tab on the Dashboard. In the *Add new appliance* dialog, choose the appliance type, then enter a name and an URL for the new appliance. 

**All appliance URLs must use the HTTPS protocol.** Note that the Manager does not validate SSL certificates automatically, so users must ensure their certificates are valid prior to connecting appliances.

The *SNMP community* field is required for the appliance to properly communicate with the Manager, and for the Manager to display accurate status information on the dashboard page. Note that the SNMP community string set here must match the string previously configured on the appliance itself.

If the selected appliance type is *TiScale Hub*, an additional field called *Load Balancer password* becomes available in the dialog. If the password is provided here, the appliance status page will display a tab with Load Balancer (HAProxy) statistics. Note that the password must be previously configured directly on the Hub, and on all Workers connected to that Hub.

Clicking `Add` for Spectra Analyze appliances will redirect to the appliance login page, where the appliance must be authorized in order to successfully connect to the Manager.

If authorization does not complete successfully, the appliances will be added to the Manager and displayed on the dashboard with *Unauthorized* status. They can be authorized at any moment from the [Appliance Status](#appliance-status-page) page.

Workers and Hubs are immediately added to the Manager after clicking `Add`, without the authorization step.

## Appliance Status Page

Apart from allowing access to *Update*, *Edit*, *Authorize*, and *Remove* options, the appliance status page provides detailed information about the system resources and health of the appliance.

If there is a problem with retrieving the status information from the appliance, a warning message is displayed at the top of the appliance status page. In this case, users should check whether the SNMP community string is properly configured for the appliance on the Manager, and on the appliance itself.

![](../images/c1000-tabs.png)

The information on the appliance status page is divided into tabs and refreshed every 5 minutes.

The appliance type - Spectra Analyze, Spectra Detect Worker, Spectra Detect Hub - determines which tabs will be visible.

| TAB             | SUPPORTED ON                          | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                 |
|------------------|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **System**       | All appliance types                   | Displays the appliance type, status, version, name, description, and uptime.                                                                                                                                                                                                                                                                                                                                                |
| **CPU**          | All appliance types                   | Displays the number of cores on the appliance, the average load over the last minute for each individual core and for all cores.                                                                                                                                                                                                                                                                                            |
| **Storage**      | All appliance types                   | Shows the total storage size (in GB), the amount of used storage (in GB and percentage) and allocation units for each partition on the appliance.                                                                                                                                                                                                                                                                              |
| **Network**      | All appliance types                   | Provides an overview of network devices on the appliance, with information about their type, operational and administrative status (up/down), physical address, bandwidth (in Mb/s or Gb/s), and the total amount of traffic received and sent.                                                                                                                                                                        |
| **Queues**       | All appliance types except Spectra Detect Hub | If supported by the appliance type, displays the state of queues on the appliance. Queues are used to communicate between various background services. The state of all queues should be “running”, and each queue should have at least one consumer (a service connected to the queue).                                                                                                                                   |
| **Processing**   | Worker only                           | If supported by the appliance type, provides statistics on the amount and size of files submitted, processed, and unpacked on the selected Worker in each of the predefined time intervals. The *Queue AVG* column indicates the average number of files in the incoming queue for each of the predefined time intervals.                                                                                                 |
| **Load Balancer**| Hub only                              | If supported by the appliance type, provides real-time information on the status of the HAProxy service used for load balancing on the Hub. The data is updated every 10 seconds. Hovering over column names in the tables provides tooltips that clarify what each column refers to. This tab is visible only if the load balancer (HAProxy) password is provided in the appliance configuration dialog.                                             |
| **Metrics**      | Worker only                           | If supported by the appliance type, displays additional file processing and post-processing statistics. The statistics track the following events: files successfully uploaded to Worker and sent for analysis; success and failure events for file processing on the Worker; success and failure events for uploading parent files to S3; success and failure events for uploading analysis reports to Splunk and Callback server (if those report uploading options are configured on Worker).   The statistics are collected for the same predefined time intervals as in the *Processing* tab, and preserved for the maximum duration of 1 day (24 hours). The statistics are collected using HTTP calls to the Worker service API, but the SNMP community string must be set for this tab to be visible. Counts in each interval automatically adjust to indicate only the events that occurred within the exact interval, while all events exceeding it are removed from the count.   Note that the count precision may be impacted if the system is under a heavier load, but it should improve within 2-3 minutes. Additionally, extracted files are not individually counted in S3 upload events - only their parent files are. This may cause discrepancies between the count of files processed on Worker versus files uploaded to S3. |

### RabbitMQ Queues

Based on the appliance type and configuration, the following RabbitMQ queues may be available.

#### Spectra Detect Worker

| Queue | Description |
| --- | ------------- |
| `tiscale.preprocessing_dispatcher` | Waits for AV analyses to complete, then routes samples to `hagent_input`, retry, or preprocessing based on thresholds and Deep Cloud Analysis settings. |
| `tiscale.hagent_result` | Stores successful analysis results from `ts-worker` for postprocessing. |
| `tiscale.hagent_url` | Handles submit-url and submit-docker-image requests: downloads samples and routes them to `hagent_input`, retry, or preprocessing based on thresholds and Deep Cloud Analysis settings. |
| `tiscale.hagent_error` | Stores failed analysis results from `ts-worker` for postprocessing. |
| `tiscale.preprocessing` | Manages subscription and upload of samples for AV scanning when Deep Cloud Analysis is enabled. |
| `tiscale.preprocessing_unpacker` | Unpacks samples before preprocessing when Deep Cloud Analysis is configured to scan child files. |
| `tiscale.hagent_input` | Receives samples for analysis. Routes to `hagent_result` on success or `hagent_retry` on failure. Preprocessing occurs first if Deep Cloud Analysis is enabled. |
| `tiscale.hagent_retry` | Handles retry attempts for failed analyses. Routes to `hagent_result` on success or `hagent_error` on final failure. |

### Additional Options

The "Upload SSL Certificate" button allows the users to apply new HTTPS certificates to Workers, Hub, or Manager.

The Actions > Download logs button downloads a support archive containing relevant system logs from all connected appliances. Appliance logs can also be downloaded using the [Download support logs endpoint](../API/ServiceAPI.md#download-support-logs).

#### Spectra Detect Hub

For Hubs that are configured as a Hub group (redundancy cluster), the appliance status page contains additional information above the tabs and a button to promote the secondary Hub into primary.

The link *Redundant with other Hub instance* allows users to quickly access the other Hub instance in the cluster, and view its status page.

## Editing and Removing Appliances

To edit an appliance, click on its row in the Dashboard to access the appliance status page. Click `Edit` to open the *Configure appliance* dialog. 

Here the name, host name, URL, and the SNMP (Simple Network Management Protocol) community string of the appliance can be modified. The HTTPS protocol is mandatory for the appliance URL. For Spectra Detect Hub appliances, it's also possible to provide the HAProxy password to enable HAProxy monitoring.

Click `Save` to save changes, or `Cancel` to return to the appliance status page without saving.

To remove an appliance, click `Remove` on the appliance status page. Confirm the removal in the popup dialog that appears at the top of the page.

To safely remove an appliance, always use the *Remove* option on the appliance status page when the appliance is online. Attempting to remove or replace an appliance by changing its URL, or removing it while it is offline will result in an error.

Appliances periodically check whether they are still connected to the Manager. If an appliance is removed improperly, the Manager will detect it, and the appliance will be automatically removed from the Manager.

## Authorizing Spectra Analyze

While Workers and Hubs are authorized automatically, Spectra Analyze appliances are not. In that case, the *Status* column in the dashboard shows an "Unauthorized" message. The `Authorization` button is visible on the status page of an unauthorized appliance, and it redirects to the authorization page on Spectra Analyze.

### Enabling Appliances Search on Spectra Analyze

Spectra Analyze appliances connected and authorized to the same Manager instance can be used to perform an Appliances Search for samples.

The Appliances Search feature looks for samples on all connected and authorized Spectra Analyze appliances, and provides links to the results on each appliance from Spectra Analyze Uploads page.

Users can search for samples by file name and sample hash. Multi-hash search is supported, and different types of hashes (for example, MD5 and SHA1) can be submitted in one query. 

A notification message will appear if an appliance is not reachable or if the search cannot be performed on an appliance.

To enable the Appliances Search feature on a Spectra Analyze appliance, access the *Administration > Configuration > Spectra Detect Manager* dialog and select the *Enable Appliances Search* checkbox.
