AS-301a · Module 2

Security Monitoring Dashboards

3 min read

A dashboard that shows everything is a dashboard that shows nothing. Security monitoring dashboards are effective when they surface the five to seven metrics that actually indicate whether the system is healthy or under attack. Everything else is noise that trains the operator to stop looking. The goal is not comprehensive visibility. The goal is actionable visibility — a screen that an on-call engineer glances at and immediately knows whether to investigate or move on.

The essential agent security dashboard has four panels. Panel one: authentication health. Successful versus failed authentication attempts across all agents, trended over time. A spike in failures indicates credential issues or active probing. Panel two: access anomalies. Agents accessing resources outside their historical baseline. This catches both compromised agents and permission drift. Panel three: agent behavior deviation. A composite score that measures how much each agent's current behavior differs from its 30-day baseline — communication patterns, task types, error rates, resource access patterns. Panel four: open vulnerabilities by severity. How many known vulnerabilities exist in your agent infrastructure right now, broken down by critical, high, medium, and low.

Do This

  • Limit dashboards to five to seven key metrics that drive investigation decisions
  • Trend every metric over time — a flat line at a bad number is different from a sudden spike
  • Set visual alert thresholds that change the panel color when a metric enters the danger zone
  • Design for glanceability — an on-call engineer should assess system health in under ten seconds

Avoid This

  • Display every available metric on a single dashboard — information overload kills attention
  • Show only current values without trends — you need to see direction of movement, not just position
  • Create dashboards that require domain expertise to interpret — the on-call engineer at 3 AM needs obvious signals
  • Treat dashboards as static — review and refine panels quarterly based on what actually drove investigations