Security graph console

The API embeds a static console at / and /ui/. After docker compose up and a scan, open http://localhost:8080. The page loads stats, findings, and a vis-network graph of the snapshot.

What you can do

Read node and edge counts in the stats strip. Those numbers come from GET /v1/graph/stats.
Scan the findings list from GET /v1/findings. Each card shows severity, title, and the affected resource. An attack-path card also prints the path node ids. Choosing a card highlights the affected resource when it is in the current snapshot.
The dropdown loads every named query. On first paint it selects internet-to-datastore when that query exists, then draws those paths. Choose Full graph snapshot to call GET /v1/graph/snapshot instead (500 nodes and 2000 edges).
A named query still uses the snapshot’s edge list to label each hop. If the connecting edge is past that 2000-edge cap, the hop is drawn as type PATH and any reason property is missing. The nodes themselves come from the query, not from the snapshot cap. Audit events returned in audits are listed under that path.
Select an identity node to load GET /v1/identity/blast-radius. The panel shows the summary and the reachable nodes. See Blast radius. Other node types do not open that panel.
Refresh reloads stats, findings, and the current view after you ingest from the CLI. The page does not poll.

Choosing a finding calls selectNodes on the canvas. That highlight only lands when the affected resource is in the view you have open. A finding about a node that is not on the current path, and not in the snapshot when you are on the full graph, stays in the list and is not drawn.

Sign in

The console signs people in with an email and password. There is no API-key field. While no admin exists, the page is a setup form. Keep the API port private until you finish it, or run om admin create --email you@example.com on the machine first. Set OM_ADMIN_EMAIL when that first address should be fixed ahead of time. See Configuration.

An admin adds the next person from the Admins panel. The temporary password is shown once. If SMTP is configured, it is emailed too. That person chooses their own password at the next sign-in. Every signed-in account is an admin, and the last admin cannot be removed.

When SMTP is configured, Forgot password? on the sign-in page emails a link to that address. The link works once and expires in one hour. It sets a new password and ends that admin's browser sessions. The page says the same thing whether or not the address is an admin. Personal API tokens stay valid. Without SMTP, the link is not shown. On the machine, om admin reset-password --email you@example.com sets a new password instead. Set OM_PUBLIC_URL so the email contains a full address.

Google and GitHub buttons appear only when that provider is configured. Register {OM_PUBLIC_URL}/auth/google/callback or {OM_PUBLIC_URL}/auth/github/callback. A verified email from the provider must already be an admin. The Security panel turns on optional authenticator-app two-factor authentication.

The browser keeps an httpOnly session cookie for 7 days. Creating an admin also creates a personal API token. The console shows it once. Scripts send that token as Authorization: Bearer or X-API-Key. The token cannot add or remove admins. Rotate it from the Admins panel when you need a new one.

Run CSPM rules from the browser

The Run CSPM rules button calls POST /v1/rules/run with the session cookie. Running om rules run on the CLI does the same work without a browser session, because the CLI uses Postgres directly.

Graph script

The graph canvas loads vis-network from /ui/vis-network.min.js, served with the rest of the console. The API does not fetch that script from a CDN.