The Overview page

What it shows

Section	What it answers
Live traffic	Prompts and responses through the firewall over the last N days, as a flow.
Capabilities	Which products are provisioned, and whether each is actually receiving signal.
Needs attention	The short list of things that are wrong right now.
Top threats	What is being detected most across your traffic.
Latest events	The most recent Runtime Security and DLP events, newest first.
Recent scans	The most recent Data Security scans and how they finished.

Sections you have no license or no permission for are not rendered.

Reading the empty states

An empty panel here means something specific, and the page says which.

What you see	What it means
Watching for traffic	The capability is live but nothing has come through the firewall yet.
Watching for signals	Provisioned, waiting for the first signal from a device or an app.
Watching for events	Connected, but no events in the selected window.
No scans yet	Data Security is available and no scan has been run.
Waiting for a connection	Nothing has connected to this workspace yet.
Could not load…	A real failure, not an empty state. Retry, then check the API is reachable.

A section that is waiting is never rendered blank. If a panel says nothing at all, that is a bug worth reporting, not an empty workspace.

Where to go from here

Overview is a status surface, not a working surface. Each panel links into the product that owns it:

Your AI Deployment

The map of the AI systems you run, at /deployment.

Apps, verdicts, drift, and the firewall itself.

Datasets, scans, healing, and RAG corpora.

Frameworks, posture, audit trail, and reports.

What it is not

It is not the compliance posture view. That is Data posture, which rolls up datasets by severity rather than showing recent activity.

It is not a report. Nothing here is exportable evidence; generate a report for that.

It is not a substitute for alerting. Set up webhooks and notifications if you need to be told rather than to look.