Live Sessions
What is passing through right now, by decision type
Ctrl K
A live view of what is passing through the appliance right now, split by the kind of decision being made. This is the screen to open when someone says “it is broken”.

- 1
- 2
- 3
- 4
- 5
- 6
| # | Control | What it does · how · why |
|---|---|---|
| 1 | Tabsgroup | Connections, Threats, Blocks, Web traffic, DNS queries, TLS sessions, Antivirus and AI Activity. Each is the same live stream filtered to one kind of event; the badge shows how much is flowing. |
| 2 | Pausebutton | Freezes the stream so you can read a row that is scrolling away. |
| 3 | Densitybutton | Compact, comfortable or detailed rows — detailed shows the full decision chain for each flow. |
| 4 | Columnsbutton | Choose which fields the table shows. |
| 5 | Filterbutton | Narrow the stream to a device, an address, a verdict or an application. |
| 6 | CSVbutton | Export what you are looking at, filters included. |