Review client monitoring changes
Open Organizations → your organization → Client spaces / Asset scopes, select a space, then choose Monitoring. The organization-context Alerts link also opens this view. The review inbox groups observations by client, dataset, asset, change type, and receipt window. The default window is 15 minutes. Expand a group to inspect every before/after observation and use its existing review, assignment, case-evidence, publication, and mute actions. All observations shows the ungrouped view.
Grouping does not classify severity, establish ownership, or merge evidence. Counts describe source observations, which can include several services or watches for one asset. External client users see only explicitly published observations; group counts never include private observations.
Use status, assignee, UTC receipt dates, and the muted-observation filter to narrow the inbox. Internal members can change the window under Grouping settings, from 1 to 60 minutes. This applies to future observations only. Existing groups, source facts, and review history remain unchanged. Windows are fixed and aligned to UTC.
The summary distinguishes groups from individual observations awaiting review. Internal members also see the latest usable collection, watches awaiting their first baseline, watch errors, failed deliveries over seven days, and remaining client envelope. A successful archive collection may still be partial; inspect run coverage before drawing conclusions. No collection is different from no observed change.
Service API
With watches:read, request GET …/clients/{id}/change-groups, then GET …/clients/{id}/changes?group={uuid}. Both return at most 50 rows per page and accept offset, status, assignee, from, to, and include_suppressed. Dates are RFC3339; to is exclusive. Filters apply before counts. Assignee filtering is internal only.
MCP exposes these through organization_records with resource change-groups, or group-changes and a group UUID as resource_id. Reading a group does not create a search or consume credits.
Updates while reviewing
The inbox signals available updates without replacing your current review. Save an edited review before choosing Load updates. If live updates are temporarily unavailable, manual reload remains available. Background tabs stop their connection until they become visible again.
Updates are isolated to the selected organization and client. The stream sends revision markers, not record contents. Permissions, session validity, and required SSO are checked before each update or heartbeat. Access removal or a changed role closes the connection and removes the old view. External recipients receive no signal for internal notes or unpublished collections.
The interface stream is separate from the upstream alert matching engine: an open connection does not mean that the underlying sources are being scanned live.
Active watch capacity
The shared server catalogue allows 3 active watches in a trial, 15 in Teams, and 40 in Business. Paused watches retain their configuration and history without using an active slot. Both creating an active watch and reactivating a paused watch check the same organization-wide limit. Stored definitions remain bounded to 100 per client and 1,000 per organization.
Collect when new observations arrive
If enabled on your installation, open Watches, create or edit a watch, and select Collect when matching observations arrive. This is a separate opt-in from daily/weekly collection. Validate the query and estimated cost before saving.
Use one explicit name/address filter:
| Dataset | Supported filters | Example |
|---|---|---|
| Hosts | host, resolution | host:*.example.com |
| DNS | host, value | host:example.com |
| Certificates | san, resolution | san:*.example.com |
| WHOIS | domain | domain:example.com |
Wildcards are supported. Combined, negative and regex queries remain available for periodic/manual collection. The backend validates the full query normally. Incoming signals are grouped, with at most one triggered collection every five minutes. Indexing and scheduling add delay: this is not instant detection. Each collection uses its quoted credits, within the watch and client limits. No separate per-event charge is added. The first collection establishes a silent baseline; changing the query, collection depth or trigger mode resets it.
The watch displays its last incoming signal and collection errors. A signal is not proof of a change: the normal collection must complete and its observations must differ from the baseline. Partial coverage never proves disappearance.
At incoming-signal capacity, narrow the query; periodic/manual collection remains available. Duplicate source messages are deduplicated within a seven-day window, limited to 5,000 stored receipts per watch. Pausing a watch prevents new triggers. Disabling this mode remains possible if an operator turns off the bridge.
The service API accepts realtime: true in a complete watch definition under
watches:write; the default is false. Preserve the field when editing or pausing
an existing watch. realtime_available on the organization reports installation
availability, not source freshness. Watch responses include last_signal_at and
realtime_error. External client accounts cannot configure watches or see these
internal diagnostics.
Organization review queue
Internal members can open Teams → Review queue or Organizations → your organization → Review queue. This view combines individual observations from accessible active spaces. Filters cover space, review status, Assigned to me, Unassigned, and Overdue. The default shows new, acknowledged and investigating observations. Muted observations are excluded. Results are paged in batches of 50; no search or collection runs when you open or filter the queue.
Expand Review and assign to reuse the space's review actions: assign a member who can access that space, add an internal note, set an optional Review due date (UTC), attach evidence to a case, or publish the observation deliberately. A date is due at the end of that UTC day. Clearing it removes the deadline. Resolved or dismissed observations are excluded from the overdue filter. Deadlines do not create reminders, notifications or escalations automatically.
The queue respects current organization membership, required SSO and space assignments. External client users cannot open it or read internal deadlines, assignees and notes. A stale revision is rejected rather than overwriting another reviewer's work. Save edits before refreshing or changing queue filters. This organization-wide endpoint is currently available through the web session; the service API retains its existing per-space monitoring endpoints.