Event review workspace
Import supplied events, inspect explicit rules and record your decisions. Local software only: no live monitoring, real containment or verified source provenance.
Start with sample data or a redacted event file.
Memory only; automatic saving is off.
Detection rules and thresholds
Threshold crossing triggers one prompt until the rolling count drops below threshold. Changing policy resets reviews. Rules do not assess source credibility, successful logins or device baselines.
Data and scope
Event fields: unique id, type (canary_access, auth_failure or device_pairing), subject, and UTC ISO timestamp at. Maximum 5,000 events. Unknown fields are discarded. Workspace restores recompute alerts from events and validate review records. Exports include identities, notes and an editable local review journal; they are not immutable audit evidence.
Use test or redacted records. Automatic saving is off by default. Browser storage is unencrypted and may be unavailable. Export snapshots for recovery; there is no account sync or recovery service. No real devices, sessions or credentials are changed.
Design approved. Software paused at ten passes for review. Native phone app, production integrations, licensing, payment delivery and independent security review remain future work.