Getting started
Console tour
The console is where operators and administrators work incidents, inspect telemetry and manage configuration. This tour describes how it is organised and how it behaves while data changes, using the sample estate and the incident INC-20931.
How it is organised#
The console has one navigation with a page for each part of the lifecycle. Pages are the same for every role; what a role can change or see inside them is governed by Roles and access.
| Page | What it is for |
|---|---|
| Overview | System health, active incidents and affected journeys. A system's health is computed from its signals, with links to the evidence |
| Incidents | The list of incidents, and for each one the grouping, impact, cause assessment, logs, timeline and recommended action. Incidents describes the detail |
| Alerts | Raw alerts from every detector, each opening the evaluations that fired it |
| Service map | Services, declared systems and the relationships between them, with the provenance of every relationship. See Service map |
| Logs | Log templates for an incident window, and a live tail. See Logs |
| Traces | Trace inspection, reached from a log line or from a service |
| Dashboards | Widgets arranged on a grid by your team. See Dashboards and reports |
| Sources | Every source with its admission counts, errors, backlog, usage and freshness. See Sources |
| Alarm definitions | Rules that evaluate signals, created and edited by administrators. See Alarm definitions |
| Destinations | Where MonitOps delivers tickets, alarms, logs and security events, with each destination's backlog and health. See Destinations |
| Actions | The catalogue of recovery actions and the run history. See Actions |
| Settings | Tenant settings, including the time zone used to present times |
The copilot opens as a panel on an incident and globally, so a question can be asked from wherever you are working. See Copilot.
What you see in the console#
When the estate is healthy, Overview lists the five services in the sample estate, checkout-web, order-api, payments-gw, crm-sync and contact-centre, all healthy. A chart of the order-api error rate sits inside its baseline band, the range MonitOps has learned as normal for that signal at that time of day.
Overview
All customer channels · Sample estateLive · updated 5 s agoorder-api error rate
Last 30 min · vs 7-day baselineWhen a service leaves its baseline, the chart marks the departure against the band and the threshold, and the affected services change health. In INC-20931 the order-api error rate leaves the band and payments-gw goes down, and the grouped incident appears in Incidents without any action from you.
Some of what a page shows depends on your role. A viewer sees incidents, the service map and dashboards, and the copilot answers within what that role can see. Attributes a viewer may not see are absent from logs and traces, not hidden behind a click. Operators can additionally acknowledge and resolve incidents and request actions, approvers can approve or reject requested actions, and administrators manage sources, declared systems, alarm definitions, destinations, dashboards and the action catalogue.
Live updates and freshness#
No view needs a browser refresh. Overview, the service map, incident lists and details, alerts, evaluated charts, predictions, dashboards and action runs update as results are committed, and Logs streams new lines as they arrive. Streaming copilot answers and AI summaries appear as they are written.
Every live view carries a freshness indicator. It shows how recent the data on screen is, so that a view that has stopped updating is visible as stale instead of looking calm. Gaps are shown rather than hidden:
- A live log tail follows new lines by default. Scrolling up pauses it and shows a count of new lines; resuming jumps to the newest.
- After an interrupted connection, the log view replays what was missed where it can, and marks any interval it could not cover.
- A truncated result or a stopped stream is labelled as such, and is never presented as complete evidence.
Source and detector freshness stay visible alongside the data they describe. A source's freshness is distinct from the time of its latest event; Source health explains the difference.
Time zone#
Times are presented in the tenant's configured time zone and labelled with it, for example 14:02:11 ICT. The time zone is set in Settings. It sets how times are presented and where days begin and end for daily figures.
Theme, wall mode and keyboard#
The console has a dark theme and a light theme. Both carry the same information. Status is never shown by colour alone: severity, priority and health always appear with a label, and keyboard focus always has a visible ring.
Wall mode removes the surrounding chrome for operations-centre screens. Sessions have idle and absolute timeouts, with an exception for wall screens; see Roles and access.
Related#
Last updated October 2026