{{ toast.title }} {{ toast.message }}

Welcome to C3

You're the first admin. Let's get C3 ready for your team.

You're Ready

{{ setupWizard.organizationName }} is set up.

{{ pageTitle }}

Viewing as {{ activeTenantName }} Impersonating {{ impersonationTarget }}
Notifications
{{ n.title }} {{ n.message }} {{ formatTime(n.created_at) }}

{{ t('empty.noNotifications') }}

{{ t('empty.noNotificationsHint') }}
{{ (currentUser.name || '?').charAt(0).toUpperCase() }}
{{ currentUser.name }} {{ currentUser.email }} {{ roleLabel(currentUser.role) }}

{{ t('socDashboard.eyebrow') }}

{{ t('socDashboard.title') }}

{{ t('socDashboard.window.label') }} {{ formatSocDashboardWindowTimestamp(socDashboardData.from) }} {{ formatSocDashboardWindowTimestamp(socDashboardData.to) }} {{ socDashboardRange === 'custom' ? t('socDashboard.window.custom') : tParams('socDashboard.window.preset', { range: socDashboardRange }) }} {{ tParams('socDashboard.window.timezone', { timezone: userTimezone() }) }} {{ tParams('socDashboard.scope.count', { count: socDashboardData.scope.tenant_count }) }}

{{ t('socDashboard.subtitle') }}

{{ t('socDashboard.range.label') }}
{{ t('socDashboard.live') }}{{ tParams('socDashboard.dataThrough', { time: formatTime(socDashboardData.to) }) }}
{{ t('socDashboard.scope.label') }}
{{ t('socDashboard.scope.currentOrganization') }}

{{ t('socDashboard.overview') }}

{{ t('socDashboard.trend.title') }}

{{ t('socDashboard.trend.subtitle') }}

{{ t('socDashboard.trend.selectedPeriod') }}
{{ tick.value }} {{ formatSocDashboardTrendLabel(label.start) }}
{{ tParams('socDashboard.trend.hoverTotal', { count: socDashboardTrendHover.values.total }) }} {{ formatSocDashboardTrendLabel(socDashboardTrendHover.start) }} · {{ t('socDashboard.trend.selectedPeriod') }}
{{ t(`socDashboard.trend.${card.key}`) }}

{{ t('socDashboard.activity.triggered.title') }}

{{ t('socDashboard.activity.triggered.subtitle') }}

{{ t('socDashboard.activity.topFive') }}
  1. {{ row.title }}{{ row.tenantLabel }}{{ row.source }}{{ row.identity_value }}
    {{ row.count }}
{{ t('socDashboard.activity.triggered.empty') }}

{{ t('socDashboard.activity.classification.title') }}

{{ t('socDashboard.activity.classification.subtitle') }}

  • {{ t(`socDashboard.activity.classification.${row.key}`) }}{{ row.count }}
{{ t(`socDashboard.activity.classification.${insight.key}`) }}{{ insight.value }}

{{ t('socDashboard.performance.eyebrow') }}

{{ t('socDashboard.performance.title') }}

{{ t('socDashboard.performance.subtitle') }}

{{ t('socDashboard.slaState.within') }}{{ t('socDashboard.slaState.near') }}{{ t('socDashboard.slaState.breached') }}

{{ t(`socDashboard.metric.${card.key}.title`) }}

{{ socDashboardSlaStateLabel(card.state) }}

{{ formatSocDashboardMetric(card.metric?.mean_seconds) }}

{{ t(`socDashboard.metric.${card.key}.definition`) }}

{{ tParams(`socDashboard.metric.${card.key}.completed`, { count: card.metric?.completed_count || 0 }) }}{{ tParams(`socDashboard.metric.${card.key}.${card.key === 'mttr' ? 'running' : 'pending'}`, { count: card.metric.pending_count }) }}

{{ t('socDashboard.categories.eyebrow') }}

{{ t('socDashboard.categories.title') }}

{{ t('socDashboard.categories.subtitle') }}

{{ t('socDashboard.slaState.within') }}{{ t('socDashboard.slaState.near') }}{{ t('socDashboard.slaState.breached') }}
{{ t('socDashboard.categories.title') }}
{{ t('socDashboard.categories.priority') }}{{ t('socDashboard.categories.alerts') }}{{ t('socDashboard.categories.mtta') }}{{ t('socDashboard.categories.respond') }}{{ t('socDashboard.categories.resolve') }}{{ t('socDashboard.categories.compliance') }}
{{ row.priority }}{{ t(`socDashboard.sla.${row.category}`) }}{{ row.alert_count }}{{ formatSocDashboardMetric(row.acknowledge?.mean_seconds) }}{{ socDashboardSlaStateLabel(row.acknowledgeState) }}{{ formatSocDashboardMetric(row.respond?.mean_seconds) }}{{ socDashboardSlaStateLabel(row.respondState) }}{{ formatSocDashboardMetric(row.resolve?.mean_seconds) }}{{ socDashboardSlaStateLabel(row.resolveState) }}
{{ outcome.label }}{{ outcome.compliant }}{{ outcome.breached }}{{ outcome.pending }}{{ outcome.notApplicable }} N/A

{{ t('socDashboard.breaches.eyebrow') }}

{{ t('socDashboard.breaches.title') }}

{{ t('socDashboard.breaches.subtitle') }}

{{ socDashboardRawSlaBreachCount }}
{{ t('socDashboard.breaches.title') }}
{{ row.title }}{{ row.alert_id }} · {{ row.tenant_id }} {{ row.priority }} {{ socDashboardBreachMetricLabel(row.metric) }} {{ formatSocDashboardMetric(row.elapsed_seconds) }} {{ formatSocDashboardMetric(row.breach_seconds) }} {{ t('socDashboard.breaches.over') }}{{ formatSocDashboardMetric(row.threshold_seconds) }} {{ t('socDashboard.breaches.target') }}
{{ t('socDashboard.breaches.noMatches') }}
{{ t('common.showing') }} {{ socDashboardSlaBreachView.start }}-{{ socDashboardSlaBreachView.end }} {{ t('common.of') }} {{ socDashboardSlaBreachView.total }}
{{ tParams('common.pageOf', { current: socDashboardSlaBreachView.page, total: socDashboardSlaBreachView.totalPages }) }}
{{ t('socDashboard.breaches.empty') }}

{{ t('socDashboard.sla.eyebrow') }}

{{ t(`socDashboard.sla.source.${socDashboardData.sla.source}`) }}

{{ t('socDashboard.sla.title') }}

{{ t('socDashboard.sla.subtitle') }}

{{ t('socDashboard.sla.mixedTitle') }}

{{ tParams('socDashboard.sla.mixedDescription', { count: socDashboardData.sla.tenant_count }) }}

{{ t('socDashboard.sla.title') }}
{{ t('socDashboard.sla.priority') }}{{ t('socDashboard.sla.acknowledge') }}{{ t('socDashboard.sla.respond') }}{{ t('socDashboard.sla.contain') }}
{{ row.priority }}{{ t(`socDashboard.sla.${row.severity}`) }} {{ formatSocDashboardCommitment(row.acknowledge_seconds) }} {{ formatSocDashboardCommitment(row.respond_seconds) }} {{ formatSocDashboardCommitment(row.contain_seconds) }}

{{ t('platform.dashboard.loadError') }}

{{ kpis.alerts?.critical || 0 }} {{ t('kpi.criticalAlerts') }}
{{ kpis.investigations?.active || 0 }} {{ t('kpi.activeInvestigations') }}
{{ kpis.playbooks?.runs_today || 0 }} {{ t('kpi.playbookRunsToday') }}
{{ kpis.tasks?.runs_today || 0 }} {{ t('kpi.agentRunsToday') }}
{{ kpis.connectors?.healthy || 0 }}/{{ kpis.connectors?.total || 0 }} {{ (kpis.connectors?.total || 0) === 0 ? t('kpi.noConnectors') : t('kpi.connectorsHealthy') }}
{{ kpis.performance?.mttd_display || '—' }} MTTD
{{ kpis.performance?.mttr_display || kpis.investigations?.avg_resolution_time || '—' }} MTTR
{{ (kpis.performance?.escalation_rate || 0).toFixed(1) }}% Escalation Rate
{{ (kpis.performance?.false_positive_rate || 0).toFixed(1) }}% False Positive Rate

Welcome to C3 — your AI-native SOC

Follow these steps to activate your first automated security workflow.

1
Connect a data source

Link your SIEM, EDR, or ticketing tool to start ingesting alerts.

2
Run your first AI task

Let the AI agent triage alerts or run a vulnerability scan.

3
Invite your team

Add analysts and viewers to collaborate on incidents.

{{ t('dashboard.triageQueue') }}

{{ t('dashboard.triageQueueSubtitle') }}
{{ t('dashboard.queue.oldestUnacked') }} {{ triageQueue.oldest_open_at ? formatRelativeTime(triageQueue.oldest_open_at) : '—' }}

{{ t('dashboard.activeThreatGroups') }}

{{ (group.origin || 'UNK').slice(0,3).toUpperCase() }} {{ group.name }} {{ group.iocs_count }} {{ t('common.iocs') }}

{{ t('empty.noActiveThreats') }}

{{ t('empty.noActiveThreatsHint') }}

{{ t('dashboard.recentAlerts') }}

{{ alert.title }} {{ alert.source }} - {{ formatRelativeTime(alert.timestamp) }}
{{ t('alert.status.' + alert.status) || alert.status }}

{{ t('empty.noRecentAlerts') }}

{{ t('empty.noRecentAlertsHint') }}

{{ t('investigations.alerts.queueTitle') }}

{{ alertSourceFilterSearch ? t('common.noMatches') : t('common.allSources') }}
{{ alertHostFilterSearch ? t('common.noMatches') : t('common.allHosts') }}
{{ assigneeFilterSearch ? t('common.noMatches') : t('investigations.alerts.assigneeFilter.empty') }}
{{ alertTenantFilterSearch ? t('common.noMatches') : t('crossTenant.noTenants') }}
{{ t('findings.table.header.severity') }} {{ t('investigations.alerts.table.id') }}
{{ t('investigations.alerts.table.alert') }}
{{ t('investigations.alerts.table.attack') }}
{{ t('investigations.alerts.table.age') }}
{{ alert.severity }} {{ alert.tenant_name || '—' }} {{ alert.title }} {{ alert.source }} {{ alert.mitre_technique }}{{ getKillChainName(alert.kill_chain_phase) }}— {{ formatAlertField(alert.host) }} {{ alertStatusLabel(alert.status) }} {{ alertClassificationLabel(alert.classification) }} {{ alertClassificationLabel('pending') }} {{ userDisplayName(alert.assignee) }} {{ formatExactTimestamp(alert.timestamp) }} {{ t('investigations.alerts.linked.short') }}
{{ t('common.showing') }} {{ alertsPagination.start }}-{{ alertsPagination.end }} {{ t('common.of') }} {{ alertsPagination.total }}
{{ tParams('common.pageOf', { current: alertsPagination.page, total: alertsPagination.totalPages }) }}

{{ t('investigations.alerts.live.title') }}

{{ tParams('investigations.alerts.live.eventCount', { count: liveEvents.length }) }} {{ liveFeedPaused ? t('investigations.alerts.live.paused') : t('investigations.alerts.live.streaming') }} · {{ liveEvents[liveEvents.length - 1].message }}

{{ t('common.loadingLiveEvents') }}

{{ formatTime(evt.timestamp) }} {{ evt.message }} {{ evt.source }} {{ evt.severity }}

{{ t('alerts.noEvents') }}

{{ alertDetailIndex() + 1 }} / {{ alertReturnContext.neighbors.length }}
{{ currentAlert.reference_id || currentAlert.id }} {{ currentAlert.severity }} {{ alertStatusLabel(currentAlert.status) }} {{ alertClassificationLabel(currentAlert.classification) }}

{{ currentAlert.title || 'Alert detail' }}

{{ currentAlert.source || 'Unknown source' }} {{ formatExactTimestamp(currentAlert.timestamp) }} {{ currentAlert.tenant_name }}

Description

{{ currentAlert.description }}

C3 ANALYSIS

Analysis Summary

AI generated {{ alertAnalysisViewState.status.replace('_', ' ') }}

{{ alertAnalysisViewState.message }}

{{ alertDetailedSummary }}
Why This Priority
{{ factor.label }}
AI TRIAGE

{{ currentAlert.triage_result.summary || currentAlert.triage_result.assessed_severity }}

Was this helpful?

Resolution
Verdict
{{ currentAlert.verdict ? t('alert.verdict.' + currentAlert.verdict) : alertClassificationLabel(currentAlert.classification) }}
Resolved by
{{ currentAlert.resolved_by ? userDisplayName(currentAlert.resolved_by) : '—' }}
Resolved at
{{ currentAlert.resolved_at ? formatTime(currentAlert.resolved_at) : '—' }}

{{ currentAlert.resolution_summary }}

Detection
Rule ID
{{ alertRawField(currentAlert, 'rule_id') || '—' }}
Rule Description
{{ alertRuleDescription(currentAlert) || '—' }}
Rule Level
{{ alertRawField(currentAlert, 'rule_level') || '—' }}
Location
{{ alertRawField(currentAlert, 'location') || '—' }}
Fired Times
{{ alertRawField(currentAlert, 'rule_firedtimes') || '—' }}
Cluster
{{ alertRawField(currentAlert, 'wazuh_cluster') || '—' }}
Program
{{ alertRawField(currentAlert, 'predecoder_program_name') }}

Process Context

Parent process
{{ alertRawField(currentAlert, 'parent_process') }}
Process
{{ alertRawField(currentAlert, 'process') }}
Domain
{{ alertDomainDisplay(currentAlert) }}
User
{{ alertUsernameDisplay(currentAlert) }}
Command line {{ alertRawField(currentAlert, 'command_line') }}
Encoded payload {{ alertEncodedExpanded ? alertRawField(currentAlert, 'encoded_command') : truncateMiddle(alertRawField(currentAlert, 'encoded_command'), 240) }}

Techniques and Indicators
Framework context

ATT&CK mapping

ATT&CK tactic{{ getMitreTacticName(currentAlert.mitre_tactic) }}
Technique{{ currentAlert.mitre_technique }}
Kill-chain phase{{ getKillChainName(currentAlert.kill_chain_phase) }}
Evidence captured

Observed indicators

{{ currentAlert.indicators.length }}
  • {{ alertIndicatorType(ioc) }}{{ alertIndicatorValue(ioc) }}
Provider evidence

Threat intelligence

{{ currentAlert.enrichment.threat_intel.matches?.length || 0 }} matched
{{ match.indicator_value || match.value || 'Matched indicator' }}{{ match.indicator_type || match.type || 'observable' }}
{{ match.source }}
Confidence
{{ alertThreatMatchConfidence(match) }}
Last seen
Country
{{ alertThreatMatchCountry(match) }}
{{ source }}

{{ t('overlay.alert.rawAlert') }}

 
{{ lazyRawAlertJson(currentAlert) }}

Recommended Actions

AI generated
  1. {{ index + 1 }}{{ step }}

No grounded recommendations available.

{{ Math.round(alertContextGraphScale * 100) }}%

Building context

Connecting evidence captured for this alert…

ANALYSIS OUTPUT

Findings

Read-only conclusions generated from this alert's detailed analysis.

{{ alertAiFindings.length }} total

AI Analysis Findings

{{ alertAiFindings.length }}

Analysis in Progress

Findings will appear here when the detailed analysis completes.

AI analysis{{ finding.confidence.charAt(0).toUpperCase() + finding.confidence.slice(1) }} confidence

{{ finding.title }}

{{ finding.detail }}

  1. {{ step }}
Generated by C3 analysis

{{ alertAnalysisViewState.status === 'not_started' ? 'Analysis has not been generated' : 'No AI findings were generated' }}

{{ alertAnalysisViewState.message }}

COLLABORATION

Notes

Append-only investigation context, decisions, and handoff notes.

This alert is linked to a case. New collaborative notes are added to the case record.
Legacy context

Legacy Analyst Note

This is the alert’s original mutable Analyst note. It is kept for compatibility; new collaboration should use append-only notes.

{{ currentAlert.investigation_notes }}
{{ note.note_type || 'note' }}
{{ note.content }}
{{ note.author_display || userDisplayName(note.author_user_id) || 'Unknown analyst' }}

Loading notes

No append-only notes yet

{{ currentAlert.investigation_id ? 'Add collaborative context in the linked case.' : 'Add the first note to preserve investigation context and decisions.' }}

{{ t('investigations.playbooks.library.title') }}

{{ playbook.category_label || (playbook.category||'Playbook').replace(/_/g,' ') }} {{ playbook.status === 'active' ? t('playbook.status.active') : t('playbook.status.inactive') }}
{{ t('investigations.playbooks.library.systemBadge') }} {{ t('investigations.playbooks.library.skillBadge') }}

{{ playbook.name || t('playbooks.unnamed') }}

{{ playbook.description || t('playbooks.noDescription') }}

{{ getKillChainName(phase) }}
{{ playbook.run_count }} {{ t('playbooks.runs') }} {{ Math.round(((playbook.success_rate || 0) * (playbook.success_rate <= 1 ? 100 : 1))) }}%
{{ playbook.last_run ? formatTime(playbook.last_run) : t('tasks.neverRun') }}

{{ t('playbooks.noMatch') }}

{{ t('common.showing') }} {{ playbooksPagination.start }}-{{ playbooksPagination.end }} {{ t('common.of') }} {{ playbooksPagination.total }}
{{ tParams('common.pageOf', { current: playbooksPagination.page, total: playbooksPagination.totalPages }) }}
{{ t('investigations.playbooks.library.systemBadge') }} {{ t('investigations.playbooks.library.skillBadge') }} {{ currentPlaybook.status === 'active' ? t('playbook.status.active') : (currentPlaybook.status === 'draft' ? 'Draft' : t('playbook.status.inactive')) }} {{ tParams('investigations.playbooks.detail.version', { version: currentPlaybook.version }) }}

{{ currentPlaybook.name }}

{{ currentPlaybook.description }}

{{ tParams('investigations.playbooks.detail.estimated', { minutes: currentPlaybook.estimated_minutes || '—', steps: (currentPlaybook.steps || []).length }) }} {{ tParams('investigations.playbooks.detail.runs', { count: currentPlaybook.run_count || 0 }) }} {{ tParams('investigations.playbooks.detail.successRate', { rate: Math.round(((currentPlaybook.success_rate || 0) * (currentPlaybook.success_rate <= 1 ? 100 : 1))) }) }} {{ currentPlaybook.last_run ? tParams('investigations.playbooks.detail.lastRun', { time: formatTime(currentPlaybook.last_run) }) : t('investigations.playbooks.detail.never') }}

{{ t('investigations.playbooks.detail.preparation') }}

{{ currentPlaybook.preparation_notes }}

{{ t('investigations.playbooks.detail.triggers') }}

  • {{ tr.field }} {{ tr.operator }} {{ Array.isArray(tr.value) ? tr.value.join(', ') : tr.value }}

{{ t('investigations.playbooks.nist.' + phase.id) }}

{{ playbookStepsByPhase(phase.id).length }}
  1. {{ step.order }}
    {{ step.name }}
    {{ step.type || 'action' }} {{ step.action }} {{ step.skill_invocation }} {{ t('investigations.playbooks.detail.stepRequiresApproval') }} {{ t('investigations.playbooks.detail.stepAuto') }} {{ tParams('investigations.playbooks.detail.stepEstimate', { seconds: step.estimated_seconds }) }}

{{ t('investigations.playbooks.detail.noSteps') }}

{{ t('investigations.cases.title') }}

{{ tParams('investigations.cases.totalCases', { count: totals.cases }) }}
{{ caseOwnerFilterSearch ? t('common.noMatches') : t('investigations.cases.ownerFilter.empty') }}
{{ caseTenantFilterSearch ? t('common.noMatches') : t('crossTenant.noTenants') }}
{{ t('investigations.cases.table.id') }} {{ t('investigations.cases.table.case') }}
{{ t('investigations.cases.table.severity') }}
{{ t('investigations.cases.table.alerts') }} {{ t('investigations.cases.table.findings') }} {{ t('investigations.cases.table.age') }}
{{ c.title }}
 {{ c.tenant_name || '—' }} {{ c.severity }} {{ caseStatusLabel(c.status) }} {{ (c.alert_ids || []).length }} {{ (c.finding_ids || []).length }} {{ formatExactTimestamp(c.opened_at) }}
{{ t('common.showing') }} {{ casesPagination.start }}-{{ casesPagination.end }} {{ t('common.of') }} {{ casesPagination.total }}
{{ tParams('common.pageOf', { current: casesPagination.page, total: casesPagination.totalPages }) }}
{{ currentCase.case_number }} {{ currentCase.severity }} {{ caseStatusLabel(currentCase.status) }}

{{ currentCase.title }}

{{ currentCase.assigned_to ? userDisplayName(currentCase.assigned_to) : (currentCase.owner?.name || '—') }} {{ currentCase.tenant_name }} {{ tParams('investigations.cases.openedAgo', { time: formatTime(currentCase.opened_at) }) }} {{ tParams('investigations.cases.updatedAgo', { time: formatTime(currentCase.updated_at) }) }}

{{ t('common.loadingCase') }}

{{ t('investigations.cases.summary.description') }}

{{ currentCase.description }}

AI Analysis

{{ t('investigations.cases.enrichment.running') }}

AI Analysis

{{ currentCase.enrichment.failure_code === 'organization_inactive' ? t('investigations.cases.enrichment.organizationInactive') : t('investigations.cases.enrichment.unavailable') }}

AI Analysis {{ enrichmentEngineLabel(currentCase.enrichment.tier2.summary) }}

Why this priority
{{ f.label }}
Classification
{{ currentCase.enrichment.classification.category }}
Risk
{{ currentCase.enrichment.risk.score }} {{ currentCase.enrichment.risk.business_impact }}
Related incidents
{{ currentCase.enrichment.correlation.count }} prior

{{ t('investigations.cases.summary.mitre') }}

{{ tac }} {{ tec }}

{{ t('investigations.cases.summary.tags') }}

{{ tag }}

Detection

Agent

Asset (CMDB)

Compliance

{{ c.framework_label }} {{ c.control }}

{{ t('investigations.cases.summary.iocCount') }} · {{ t('investigations.cases.summary.assetCount') }} · {{ t('investigations.cases.summary.taskCount') }}

{{ caseIOCs.length || (currentCase.ioc_count || 0) }} {{ t('investigations.cases.summary.iocCount') }} {{ (currentCaseChildren?.assets || []).length || (currentCase.asset_count || 0) }} {{ t('investigations.cases.summary.assetCount') }} {{ (currentCaseChildren?.notes || []).length || (currentCase.note_count || 0) }} {{ t('investigations.cases.summary.noteCount') }} {{ caseTasksByStatus('done').length + '/' + (currentCaseChildren?.tasks || []).length }} {{ t('investigations.cases.summary.taskCount') }}

{{ t('investigations.cases.alerts.title') }}

{{ caseLinkedAlerts.length }}
{{ t('findings.table.header.severity') }} {{ t('investigations.alerts.table.id') }} {{ t('investigations.alerts.table.alert') }} {{ t('common.source') }} {{ t('alert.fields.host') }} {{ t('common.status') }} {{ t('findings.table.header.time') }}
{{ alert.severity }} {{ alert.title }} {{ alert.source }} {{ formatAlertField(alert.host) }} {{ alertStatusLabel(alert.status) }} {{ alertClassificationLabel(alert.classification) }} {{ formatTime(alert.timestamp) }}

{{ t('investigations.cases.alerts.empty') }}

{{ t('investigations.cases.timeline.title') }}

{{ tParams('investigations.cases.timeline.events', { count: caseTimeline.length }) }}
Loading timeline…
  1. {{ formatTimelineTime(evt.timestamp) }} {{ timelineEventLabel(evt.type) }} {{ evt.severity }} From alert {{ shortEntityId(evt.metadata.source_alert_id) }}
    {{ timelineEventTitle(evt) }}

    {{ timelineEventDescription(evt) }}

{{ t('investigations.cases.timeline.empty') }}

{{ t('investigations.cases.findings.title') }}

{{ caseFindingsDisplay.length }}
{{ caseEnrichmentLoading ? t('investigations.cases.enrichment.findingsRunning') : t('investigations.cases.findings.loading') }}

{{ t('investigations.cases.findings.empty') }}

{{ t('investigations.cases.findings.emptyHint') }}
Severity Finding Type From run When

{{ t('investigations.cases.iocs.title') }}

{{ caseIOCs.length }}
Loading IOCs…
{{ t('investigations.cases.iocs.table.type') }} {{ t('investigations.cases.iocs.table.value') }} {{ t('investigations.cases.iocs.table.confidence') }} {{ t('investigations.cases.iocs.table.source') }} Tags {{ t('investigations.cases.iocs.table.firstSeen') }}
{{ ioc.type }} {{ ioc.value }} {{ iocConfidencePct(ioc) }}% {{ iocSourcesSummary(ioc) }} {{ tag }} — {{ ioc.first_seen ? formatTime(ioc.first_seen) : '—' }}

{{ t('investigations.cases.iocs.empty') }}

{{ t('investigations.cases.assets.title') }}

{{ (currentCaseChildren?.assets || []).length }}
{{ t('investigations.cases.assets.table.name') }} {{ t('investigations.cases.assets.table.type') }} {{ t('investigations.cases.assets.table.identifier') }} {{ t('investigations.cases.assets.table.criticality') }} {{ t('investigations.cases.assets.table.compromise') }} {{ t('investigations.cases.assets.table.analysis') }}
{{ a.name }} ×{{ a.source_alert_count }} {{ a.asset_type || a.type }} {{ a.ip || a.domain || a.os || a.owner || '—' }} {{ a.criticality || '—' }} {{ formatCaseStatusLabel(a.compromise_status) }} {{ formatCaseStatusLabel(a.analysis_status) }}

{{ t('investigations.cases.assets.empty') }}

{{ t('investigations.cases.notes.title') }}

{{ (currentCaseChildren?.notes || []).length }}
{{ userDisplayName(n.author) }} {{ n.note_type }} From alert {{ shortEntityId(n.source_alert_id) }} {{ formatTime(n.ts) }} {{ tag }}

{{ t('investigations.cases.notes.empty') }}

{{ t('investigations.cases.artifacts.title') }}

{{ fileCountLabel(caseArtifactsCount) }} · {{ humanSize(caseArtifactsTree?.total_size_bytes || 0) }}

This closed case is read-only. Existing artifacts remain available to preview and download.
Uploads {{ artifactPolicySummary() }}
  • {{ item.file.name }} {{ humanSize(item.file.size) }} · {{ artifactQueueStatus(item) }} {{ item.error.message }}

{{ caseArtifactUploadLiveMessage }}

{{ t('investigations.cases.artifacts.loading') }}

{{ t('investigations.cases.artifacts.empty') }}

Manual uploads {{ fileCountLabel(caseArtifactsTree.manual_uploads.length) }}
{{ pb.playbook_name }} {{ pb.total_runs }} runs · {{ fileCountLabel(pb.total_artifacts) }} · {{ humanSize(pb.total_size_bytes) }}
Run {{ (run.run_id || '').slice(0, 8) }} {{ formatFullTime(run.started_at) }} {{ fileCountLabel((run.artifacts || []).length) }} {{ run.status }}
{{ t('investigations.cases.artifacts.adhocTasks') }} {{ caseArtifactsTree.tasks.length }} runs
{{ task.task_name || ('Run ' + (task.run_id || '').slice(0, 8)) }} {{ formatFullTime(task.started_at) }} {{ fileCountLabel((task.artifacts || []).length) }}

{{ t('investigations.cases.tasks.title') }}

{{ col === 'todo' ? t('investigations.cases.tasks.col.todo') : (col === 'in_progress' ? t('investigations.cases.tasks.col.inProgress') : t('investigations.cases.tasks.col.done')) }}
{{ caseTasksByStatus(col).length }}
{{ t.title }}
{{ t.description }}
{{ userDisplayName(t.assignee) }} {{ t.priority }} {{ formatTime(t.due_date) }}
{{ t('investigations.cases.tasks.empty.column') }}
Operational intelligence
Checking source freshness {{ threatIntelDegradedSources.length }} source{{ threatIntelDegradedSources.length === 1 ? '' : 's' }} need attention All {{ threatIntelSourceHealth.length }} sources current No sources reporting
Updated {{ formatRelativeTime(threatIntelLastRefresh) }}
Some intelligence may be incomplete {{ threatIntelDegradedSources.map(source => source.message ? source.name + ': ' + source.message : source.name + ' is stale or degraded.').join(' ') }}
Sources
{{ source.name }}Platform managed{{ source.status }}
Platform threat intelligence is not available for this organization

Threat landscape

{{ isCrossTenantView ? 'Shared global intelligence with operational impact isolated to the organizations in your active Investigations scope.' : 'Global and organization intelligence prioritized by matches in your operations.' }}

{{ threatIntelScopeLabel }}
No threat intelligence yet

Connect and sync an approved source to build the intelligence catalog.

Operational matches

Threat indicators matched to active alerts. Tenant data remains restricted to your Investigations scope.

{{ formatNumber(totals.intelMatches) }} total
Matched indicatorAlertTenantMatched fieldLast matchedDispositionOpen
{{ match.indicator_value || 'Indicator unavailable' }}{{ match.indicator_type || 'unknown' }}
 {{ match.alert_title || match.alert_id || 'Alert unavailable' }}Case linked {{ match.tenant_name || match.tenant_id }} {{ match.matched_field || 'Exact normalized value' }} {{ match.matched_at ? formatTime(match.matched_at) : '—' }} {{ match.disposition || 'new' }}
{{ isGlobalAdmin && !activeTenantId ? 'Catalog-only view' : (hasActiveThreatMatchFilters ? 'No matches found' : 'No active threat matches') }}

{{ isGlobalAdmin && !activeTenantId ? 'Select an organization context to inspect operational matches. Global catalog access never exposes tenant alerts.' : (hasActiveThreatMatchFilters ? 'Try a broader search or reset the filters.' : 'Matches appear when an active alert contains an indicator from an enabled source.') }}

Showing {{ intelMatchesPagination.start }}-{{ intelMatchesPagination.end }} of {{ intelMatchesPagination.total }}
Page {{ intelMatchesPagination.page }} of {{ intelMatchesPagination.totalPages }}

Indicators

Deduplicated artifacts with source evidence and C3 matches.

{{ formatNumber(totals.intelIndicators) }} total
IndicatorScoreStatusSourcesLast seenMatchesOpen
{{ indicator.value }}{{ indicator.type }}
{{ indicator.operational_score ?? '—' }}Operational relevance
 {{ indicator.lifecycle_status || 'unknown' }}
{{ source }}+{{ indicator.source_count - 2 }}No source
 {{ indicator.last_seen ? formatTime(indicator.last_seen) : '—' }} No matches
{{ hasActiveThreatIndicatorFilters ? 'No indicators match these filters' : 'No indicators ingested' }}

{{ hasActiveThreatIndicatorFilters ? (filters.intelIndicators.search && filters.intelIndicators.status === 'active' ? 'No current source assertion matches this value. Check inactive history if the indicator appeared in an earlier provider snapshot.' : 'Broaden or reset the filters to see more intelligence.') : 'Connect and sync an approved source. C3 will not substitute seeded data.' }}

Showing {{ intelIndicatorsPagination.start }}-{{ intelIndicatorsPagination.end }} of {{ intelIndicatorsPagination.total }}
Page {{ intelIndicatorsPagination.page }} of {{ intelIndicatorsPagination.totalPages }}

Reports

Source intelligence packages with entities, indicators, and C3 relevance.

{{ formatNumber(totals.intelReports) }} total
{{ report.source }}{{ report.report_type }}{{ report.tlp }}

{{ report.title }}

{{ report.summary || 'No summary was supplied by this source.' }}

{{ report.indicator_count || 0 }} indicators{{ report.alert_match_count || 0 }} alert matches
{{ hasActiveThreatReportFilters ? 'No reports match these filters' : 'No reports ingested' }}

{{ hasActiveThreatReportFilters ? 'Broaden or reset the filters to see more reports.' : 'Reports will appear after an approved intelligence source is synced.' }}

Showing {{ intelReportsPagination.start }}-{{ intelReportsPagination.end }} of {{ intelReportsPagination.total }}
Page {{ intelReportsPagination.page }} of {{ intelReportsPagination.totalPages }}

{{ t('approvals.queue') }}

{{ t('common.loading') }}

{{ t('approvals.noApprovals') }}

{{ t('approvals.noApprovalsHint') }}
{{ approval.status }} {{ approval.workflow_type }} {{ new Date(approval.created_at).toLocaleString() }}
{{ approval.step_name }}
{{ t('approvals.requiredRole') }}: {{ approval.required_role }} {{ t('approvals.quorum') }}: {{ approval.current_approvals }}/{{ approval.quorum }}

{{ t('approvals.aiDecisions') }}

${{ (aiCostSummary.total_cost_usd || 0).toFixed(4) }}
{{ t('aiDecisions.cost') }} (30d)
{{ (aiCostSummary.total_tokens || 0).toLocaleString() }}
{{ t('aiDecisions.tokens') }} (30d)
{{ aiCostSummary.total_requests || 0 }}
Requests (30d)
{{ t('common.loading') }}
{{ t('aiDecisions.contextType') }} Skill {{ t('aiDecisions.model') }} {{ t('aiDecisions.tokens') }} {{ t('aiDecisions.cost') }} {{ t('aiDecisions.latency') }} {{ t('aiDecisions.fallback') }} Time
{{ log.context_type }} {{ log.skill_name || '\u2014' }} {{ log.model_used }} {{ log.total_tokens != null ? log.total_tokens.toLocaleString() : '\u2014' }} {{ log.cost_usd != null ? '$' + log.cost_usd.toFixed(4) : '\u2014' }} {{ log.latency_ms != null ? log.latency_ms + 'ms' : '\u2014' }} YesNo {{ new Date(log.created_at).toLocaleString() }}
{{ t('empty.noAiDecisions') }}

{{ t('page.platform') }}

{{ t('platform.admin.hint') }}

{{ t('platform.admin.loading') }}

Name Slug Tenant ID Tier Status Admin Email Members Provider Created Actions
{{ org.name }} {{ org.slug }} {{ org.id }} {{ org.tier || 'free' }} {{ org.status }} {{ org.admin_email || '-' }} {{ org.member_count ?? 0 }} {{ org.created_at ? new Date(org.created_at).toLocaleDateString() : '-' }}

{{ t('platform.admin.noOrgs') }}

{{ t('settings.connectors.title') }}

{{ t('empty.noConnectorsConfigured') }}

{{ t('empty.noConnectorsConfiguredHint') }}
{{ group.type.display_name }} {{ group.vendors.length }} product{{ group.vendors.length !== 1 ? 's' : '' }}
{{ t('connector.status.' + String(item.connector.status || '').toLowerCase()) }} {{ (item.connector.scope || 'org') === 'user' ? t('settings.connectors.scope.personal') : t('settings.connectors.scope.organization') }}

{{ item.vendor.display_name }}

{{ item.vendor.description || group.type.display_name }}
Last alert {{ formatRelativeTime(item.connector.last_alert_received_at) }} No alerts yet
{{ formatTime(item.connector.last_sync) }}
{{ t('settings.connectors.notSyncedYet') }}
{{ formatNumber(item.connector.events_24h) }} {{ t('common.eventsPer24h') }} {{ item.connector.alerts_24h }} {{ t('overlay.connector.alerts') }}

{{ t('common.loadingConnectors') }}

{{ t('empty.noConnectorsFound') }}

{{ group.type.display_name }} {{ group.vendors.length }} product{{ group.vendors.length !== 1 ? 's' : '' }}
{{ t('connector.status.' + String(item.connector.status || '').toLowerCase()) }} AVAILABLE

{{ item.vendor.display_name }}

{{ item.vendor.description || group.type.display_name }}
Last alert {{ formatRelativeTime(item.connector.last_alert_received_at) }} No alerts yet
{{ formatTime(item.connector.last_sync) }}
{{ t('settings.connectors.notSyncedYet') }}
{{ formatNumber(item.connector.events_24h) }} {{ t('common.eventsPer24h') }} {{ item.connector.alerts_24h }} {{ t('overlay.connector.alerts') }}
Coming Soon

{{ t('settings.team.title') }}

{{ t('common.loadingTeam') }}

No team members found

User Role Department Status Last Active Actions
{{ (member.name || ' ').charAt(0).toUpperCase() }}
{{ member.name }}
{{ member.email }}
Provider access Derived from {{ member.source_organization_name || 'provider organization' }}
{{ roleLabel(member.role) }} {{ member.department || '—' }} {{ member.status === 'invited' ? 'Invited' : (t('settings.team.status.' + member.status) || member.status) }} {{ member.status === 'invited' ? '—' : formatTime(member.last_active) }}
Managed by provider
{{ t('common.showing') }} {{ teamPagination.start }}-{{ teamPagination.end }} {{ t('common.of') }} {{ teamPagination.total }}
{{ tParams('common.pageOf', { current: teamPagination.page, total: teamPagination.totalPages }) }}

Security

{{ (currentUser?.name || '?').charAt(0).toUpperCase() }}

{{ currentUser?.name || '—' }}

{{ currentUser?.email || '—' }}

{{ roleLabel(currentUser?.role) }}
{{ currentUser.department }}
{{ currentUser.title }}

Edit Profile

{{ profileEdit.error }}

Two-Factor Authentication

Add an extra layer of security with a TOTP authenticator app.

{{ security.mfaEnabled ? 'Enabled' : 'Disabled' }}

Your account is protected with two-factor authentication.

Generating your MFA secret...

Scan this QR code with your authenticator app

Can't scan? Enter this key manually
{{ security.mfaSecret }}

{{ security.mfaSetupStep === 'confirm' ? 'Verifying...' : 'Disabling MFA...' }}

Change Password

Update your password. Other sessions will be revoked.

{{ passwordStrength(security.passwordForm.newPassword).label }}
8+ characters Uppercase Lowercase Number Special char
{{ security.passwordForm.newPassword === security.passwordForm.confirmPassword ? 'Passwords match' : 'Passwords don\'t match' }}

Active Sessions

Manage devices where you're currently logged in.

Loading sessions...

{{ t('empty.noActiveSessions') }}

{{ t('empty.noActiveSessionsHint') }}
{{ session.device_label || 'Unknown Device' }} This device {{ session.ip_address || 'Unknown IP' }}

{{ t('tabs.preferences') }}

{{ t('common.loadingPreferences') }}

Notifications

{{ t('prefs.display') }}

{{ t('settings.reporting.title') || 'Reporting' }}

This feature is coming soon

Platform Settings

Manage API keys, model configuration, and integration secrets. Sensitive values are encrypted at rest.

Loading platform settings...

{{ t('empty.noPlatformSettings') }}

{{ t('empty.noPlatformSettingsHint') }}

{{ t('settings.sla.title') }}

{{ t(`settings.sla.source.${slaPolicy.source}`) }}

{{ t('settings.sla.description') }}

{{ t('common.loadingSla') }}

{{ t('settings.sla.selectOrganizationTitle') }}

{{ t('settings.sla.selectOrganization') }}

{{ t('settings.network.title') }}

{{ t('settings.network.description') }}

{{ t('common.loadingNetwork') }}

{{ t('settings.network.name') }} {{ t('settings.network.type') }} {{ t('settings.network.ip') }} {{ t('settings.network.status') }}
{{ device.name }} {{ device.device_type || device.type || t('common.unknown') }} {{ device.management_ip || device.ip_address || device.ip || '-' }} {{ device.status || t('common.unknown') }}

{{ t('settings.network.empty') }}

{{ t('empty.networkHint') }}

Remote Runners

Runners execute C3 tasks on your own infrastructure. Skills are fetched from the server per-job and cleaned up after execution — nothing is persisted on the runner.

Registration Token Generated
Step 1 — Prerequisites

Ensure Docker is installed on the target machine. The runner requires outbound HTTPS access to {{ serverOrigin }}. No inbound ports are needed.

Step 2 — Pull the Runner Image

Log in to the container registry with the access token provided by your C3 administrator, then pull the image:

docker login ghcr.io -u c3-customer -p <GHCR_ACCESS_TOKEN>
docker pull ghcr.io/zysec-ai/c3-task-runner:latest
Step 3 — Start the Runner

Copy and run this command. Replace my-runner with a descriptive name for this runner.

{{ getRunnerInstallCommand() }}
Step 4 — Verify

Once the runner starts, it will automatically register and appear in the list below with an idle status. The registration token expires in 1 hour and can only be used once.

Show raw registration token {{ runnerRegistrationToken }}

Loading runners...

No runners registered yet

Runners let you execute C3 tasks on your own hardware using your own AI provider keys.

Click "Add Runner" above to generate a one-time registration token and get setup instructions.

Name Status Queue Labels Last Seen Version
{{ runner.display_name || runner.name }} {{ runner.name }} {{ runner.status }} {{ runner.queue_depth }} 0 {{ runner.labels.join(', ') || '\u2014' }} {{ runner.last_seen_at ? new Date(runner.last_seen_at).toLocaleString() : '\u2014' }} {{ runner.version || '\u2014' }}

Loading CustomerOps...

Outbound integration

CustomerOps

Push case, alert, and finding changes to CustomerOps. Pull sync credentials below support full tenant repair snapshots.

{{ customerOpsStatusLabel() }}
{{ customerOps.config?.pending_count || 0 }} Pending
{{ customerOps.config?.failed_count || 0 }} Failed
{{ customerOps.config?.dead_letter_count || 0 }} Dead letter
{{ customerOps.config?.blocked_count || 0 }} Blocked

Push delivery

Configure the signed webhook that receives incremental C3 events.

{{ customerOps.config?.has_signing_secret ? 'Secret configured' : 'Secret required before enabling' }} Rotated {{ formatRelativeTime(customerOps.config.secret_rotated_at) }}

Pull full sync

Share this key with CustomerOps for tenant-scoped snapshot repair.

Key ID {{ customerOps.pullCredential?.key_id || 'Not generated' }}
Secret {{ customerOps.pullSecret }}
The pull secret is shown only after rotation. Generate a new key when CustomerOps is ready to capture it.
Enabled{{ customerOps.pullCredential?.enabled ? 'Yes' : 'No' }}
Last used{{ customerOps.pullCredential?.last_used_at ? formatRelativeTime(customerOps.pullCredential.last_used_at) : 'Never' }}
Rotated{{ customerOps.pullCredential?.rotated_at ? formatRelativeTime(customerOps.pullCredential.rotated_at) : 'Not generated' }}
{{ customerOps.error }}
{{ customerOps.testResult.message }}
{{ customerOps.config.last_error }}
Delivery gap detected since {{ formatFullTime(customerOps.config.integration_gap_since) }}. Create a snapshot after the endpoint is healthy.
Snapshot {{ customerOps.bootstrapResult.snapshot_id || customerOps.bootstrapResult.snapshotId }} ready.

{{ t('tabs.recipients') }}

{{ t('recipients.help') }}

{{ t('recipients.loading') }}
{{ t('recipients.emailsLabel') }} {{ orgRecipients.emails.length }}

{{ orgRecipients.error }}

{{ t('recipients.empty') }}

{{ t('investigations.alerts.resolve.title') }}

{{ tParams('investigations.alerts.resolve.intro', { title: resolveModal.alertTitle }) }}

{{ t('investigations.alerts.resolve.noteRequired') }}

{{ caseTaskModal.editing ? 'Edit task' : 'New task' }}

{{ t('investigations.cases.create.title') }}

{{ t('investigations.cases.create.tenantHint') }}

{{ t('investigations.cases.reopen.title') }}

This case will return to Open and be assigned to you. Existing history and evidence remain available.

Change case status

{{ caseStatusLabel(currentCase.status) }}

Loading…
No transitions available from this status.

Recorded on the case timeline so the audit trail stays complete.

Add {{ webhookVendorLabel(wazuhCreate.vendorId) }}

Grafana is push-only. We'll generate a webhook URL and a one-time token; you'll paste them into a Grafana webhook contact point (Authentication header scheme Bearer).

Splunk is push-only. We'll generate a webhook URL and one-time token for the C3 custom alert action attached to your saved or correlation searches.

Wazuh is push-only. We'll generate a webhook URL and a one-time token; you'll paste them into your Wazuh manager's ossec.conf.

{{ wazuhCreate.errors.name }}

One connector per Grafana instance. Use the environment to distinguish them.

Use one connector per Splunk deployment or search-head cluster.

One connector per Wazuh manager. Use the environment to distinguish them.

Personal (only you)

{{ wazuhWizard.connectorName }} · Setup

Loading setup bundle…
  1. 1
    {{ wazuhWizard.vendorId === 'splunk' ? 'Your C3 delivery endpoint' : 'Your webhook URL' }}

    The packaged alert action builds this endpoint from the C3 base URL and connector ID shown in step 4. You do not paste this full URL into Splunk.

    Not a secret on its own — but it identifies your connector. The token (next step) is what authenticates.

    {{ wazuhWizard.bundle.webhook_url }}
  2. 2
    Webhook token shown once

{{ wazuhDetail.connector?.name || webhookVendorLabel(wazuhDetail.vendorId) }}

{{ wazuhDetail.connector.status }}
Loading…