Description
Security Operations Analytics gives DOTS staff a cross-tenant trust lens over the authority plane without exposing customer content. It summarizes access denials, authority changes, operator actions, and active operators, adds prior-window deltas and a denials trend, breaks events down by type, and embeds the most recent operator audit activity. The selected 24-hour, 7-day, or 30-day range controls activity metrics while active-operator count remains a current-state measure.
The service reads aggregate security events and staff metadata through the sanctioned platform projection. Customer-level payloads and content remain outside the response. The console clearly separates staff audience from buyer-facing Access settings, and both route and navigation enforce the platform metrics atom before the page can load.
Selling Points
- Shows whether denied actions and authority changes are accelerating across the fleet, not merely how many exist.
- Combines customer access-plane signals with staff operator activity for a more complete trust posture.
- Provides event-type distributions that help operators distinguish credential, role, approval, and denial patterns.
- Embeds recent staff audit rows so a spike can be connected to accountable operator actions.
- Preserves the customer-content firewall by limiting results to counts, trends, types, and operator metadata.
User Story
A security operator opens the lens after a denial alert and selects the previous 24 hours. They confirm the denial increase against the prior window, identify the dominant event types, and review recent operator actions for a plausible administrative cause. They can then move to the appropriate detailed audit surface. The operator walks away with a fleet-level security narrative rather than raw uncorrelated logs.
Extension Surface
This capability is automatable. packages/api/src/routes/platform.ts exposes the same security summary rendered in apps/admin/src/modules/security/components/SecurityPage.tsx. The event taxonomy and SQL aggregation in packages/platform/src/internal/service.ts are fixed platform behavior; callers may retrieve results programmatically but cannot register external security-card or event-family plugins.
Capabilities & Limits
- Reports denial, authority-change, operator-action, and active-operator KPIs with deltas.
- Provides a denial trend, event distributions, and recent operator audit metadata.
- Supports three time windows with fail-closed staff permission gating.
- Does not reveal customer content or provide direct tenant impersonation.
- It is an aggregate operations lens, not a replacement for the workspace Access Audit Log.
Implementation Map
packages/platform/src/internal/service.tspackages/db/src/schema/access-audit-log.tspackages/db/src/schema/platform-operator-audit.tsapps/admin/src/modules/security/components/SecurityPage.tsx