Authorized access for Super Admin, Admin and NOC Operator.
Two-Step Verification
Enter the 6-digit code from Google Authenticator. A recovery code also works.
Password recovery
Submit a recovery request. A Super Admin can issue a secure one-time reset link.
Set new password
Use at least 12 characters. This link can only be used once.
🔒 Authorized users only · Security activity is logged
IdealNOCSECURE ACCOUNT ACTIVATION
Create your new password
Your temporary password has already authenticated this session. Set a permanent password before continuing.
Use at least 12 characters. Avoid reusing passwords from email, Microsoft 365, VPN or other admin systems.
Enable Google Authenticator
Scan the QR code with Google Authenticator, then enter the current 6-digit code to verify the enrollment.
1. Open Google Authenticator
Tap +, choose Scan a QR code, and scan the code shown here.
Manual setup key
Save your recovery codes
Each code can be used once if Google Authenticator is unavailable. Store them somewhere secure and separate from this computer.
Important: IdealNOC will not show these codes again. Super Admin can reset MFA later if required.
IdealNOCNETWORK OPERATIONS CENTER
IDEALNOC COMMAND CENTERNOC / SOC MONITORING ACTIVE
Endpoints
0
PC & Server
Network
0
Managed assets
Warning
0
Needs review
Critical
0
Immediate attention
MONITORING INTAKE
No telemetry sources deployed
Site Collector: not deployed
Endpoint Agent: not deployed
NOC Dashboard
Region → Company → Site → Endpoint / Network
IdealNOC Central · MSI · v0.6.6
Companies0Managed customers
Sites0Registered locations
Total Assets0Endpoints + network
Open Incidents0Active cases
Customer Health
Incident Feed
Companies & Sites
Customer onboarding, service coverage, escalation contacts, operating hours and site hierarchy.
Monitoring policy follows the customer model: each company has a weekly operating schedule; each site may inherit it or define a local override. 24x7 assets always remain alertable.
No companies onboardedCreate the first customer company. Sites and monitored assets will remain empty until a real deployment is enrolled.
Company
Country / Region
Primary Contact
Coverage
Sites
Assets
Status
Action
Sites
Select a company above to view its sites.
Select a companyChoose a company above to view only its related sites.
Site
Company
Type
WAN / ISP
Timezone
Collector
Status
Action
Endpoints & Network
Cloud control plane for Site Collectors and their synchronized local inventory.
Architecture: Add only the Ubuntu Site Collector in the Central portal. Windows endpoints and network devices are created/discovered locally and synchronized upward. IdealNOC Central does not perform customer-LAN polling.
No Site Collectors registeredCreate the first Site Collector after a company and site exist. The portal will generate a one-time 8-digit enrollment code.
Collector
Company / Site
Status
Version
Inventory
Last Seen
Update
Action
Collector
Central TransportHTTPS 443 outbound
Release Channel—
Endpoint Count0
Network Count0
No synchronized inventoryInventory will appear here after the local Collector enrolls endpoints or network equipment.
Asset
Type
IP / MAC
Platform / Model
Agent / Source
Status
Last Seen
Unified Incidents
One operator queue for availability, performance and security incidents.
0 active
No active incidentsNew NOC or SOC incidents will appear here automatically.
Domain
Severity
Incident
Customer / Site
Risk
Status
Opened
Actions
SOC Overview
Central security telemetry, deterministic detection, threat intelligence and AI-ready incident evidence.
Development Full Telemetry Mode: raw security logs are retained centrally for 3 days. Normalized events and findings are automatically retained longer. AI analyzes selected correlated evidence—not every raw event.
Raw Events · 24h0
Normalized: 0
Findings · 24h0
Deterministic + correlated
Open SOC Incidents0
Operator action queue
Active Threat Indicators0
0 intelligence sources
SOC Engine Health
Retention & Capacity
Open Finding Severity
No security findings yet.
Recent Security Findings
No findings yet. This will populate from real Endpoint Agent, firewall, Syslog and network telemetry.
Detected
Severity
Title
Confidence
Source
MITRE
Threat Intel
Security Events
Normalized SOC events from endpoint, network, firewall, authentication and security sources.
Storage policy: detailed raw logs are retained for 3 days. This screen shows normalized security events retained for 14 days by default.
No normalized security events yetEvents appear after a real Collector starts sending security telemetry.
Time
Severity
Category
Event
Confidence
Rule
Indicator
MITRE
Threat Intelligence
MISP + OpenCTI intelligence layer for IOC lifecycle, relationships and SOC enrichment.
MISP · IOC Intelligence Master
Aggregates, deduplicates and manages active indicators from external intelligence feeds and IdealNOC discoveries.
Checking…
OpenCTI · Threat Knowledge Graph
Provides deeper relationships between indicators, malware, campaigns, actors, vulnerabilities and MITRE ATT&CK context.
Checking…
Fast IOC Cache
Real-time detections use this local cache instead of waiting for Internet API calls.
Loading…
Checking local intelligence cache…
IdealNOC Intelligence Path
External Feeds→MISP→Fast IOC Cache→Rules & Correlation→OpenCTI→AI Analyst
Intelligence Sources
Real configuration status. API keys are encrypted and never returned to the browser.
Loading…
Source
Category
Mode
Status
Refresh
Key
Last Sync / Status
Action
Settings / Users & Roles
Users & Roles
Manage portal identity, role, password lifecycle and multi-factor authentication.
User
Role
MFA
Status
Last Login
Action
Network Map
Manual Visio-style topology editor.
Network Map foundation reservedDrag/drop asset map will be built after customer/site management is complete.
NOC Display
TV wall and pop-out customer monitoring views.
NOC Display foundation reservedCompany pop-out windows and wall layouts come next.
Notifications
Endpoint cybersecurity advisories and customer notices.
Notification ManagementTarget by company, site or endpoint and publish a full article link.
Software Management
Signed, versioned installation packages and controlled rollout channels.
Version policy: Portal/API, Site Collector and Endpoint Agent use independent semantic versions. Packages are rebuilt only when their code or protocol compatibility requires it—not for every portal UI update.
Installs the Collector service, local web portal, local storage/buffer, monitoring engine, updater and systemd service configuration. After installation, browse to the Collector local URL and enroll it with IdealNOC Central.
Approved Canary packages appear here only after build, automated test and SHA-256 verification. Production signing remains a separate release gate.
IdealNOC Endpoint Agent
Windows 10/11/Server · x64 · signed MSI/EXE
No approved release
Installs IdealNOC Agent and Update Service with normal Windows Service Recovery. The agent enrolls against the local Site Collector—not directly to IdealNOC Central.
The Windows package will be code-signed and SHA-256 verified before it becomes downloadable from this portal.
Approved Releases
No approved installer packages yetRelease entries appear only after a real artifact has passed internal test, signature/hash verification and approval.
Product
Version
Platform
Channel
Signing
SHA-256
Approved
Download
Settings / WhatsApp Alerting
WhatsApp Alerting
WAHA/GOWS gateway, recipient groups, severity routing and escalation policy.
Gateway not configured yetThis module is reserved for the production WAHA/GOWS integration. It will route incidents by company, site, severity and escalation level; no fake recipient data is shown.
Settings
System administration and integration configuration.
Users & Roles
Portal users, RBAC, temporary-password lifecycle and Google Authenticator reset.
WhatsApp Alerting
WAHA/GOWS gateway, recipient groups, severity routing and escalation policies.
AI / LLM Providers
Configure OpenAI / ChatGPT API, Google Gemini or a future local Ollama endpoint for IdealNOC AI Analyst.
Threat Intelligence
MISP, OpenCTI and external threat-intelligence provider configuration for the SOC engine.
System Health
Central runtime, NOC/SOC engines, threat-intelligence services, storage capacity and retention status.
Settings / System Health
System Health
Operational status of the IdealNOC Central services and protected data-retention layer.
IdealNOC Central Runtime
Backend services are isolated; customer-facing monitoring uses one unified control plane.
Checking…
Runtime Services
Service
Version
Status
Heartbeat
Last Error
Storage Capacity
Loading…
Retention Policy
Loading…
Settings / AI & LLM Providers
AI / LLM Providers
Provider-neutral configuration for IdealNOC AI Analyst. API keys are encrypted before storage.
Cost control: AI is used only for selected incident evidence and operator-requested analysis, never for every raw telemetry sample. Ollama will require a secure private connector/tunnel to the local model host.