Security Ops

Use this when your team needs a daily view of AI security events, approvals, incidents, redactions, quarantined documents, and policy-tuning signals.

Security Ops is the operator console for reviewing what Firefish protected and what still needs attention.

What it shows

• Protected request totals.
• Blocked actions.
• Redactions.
• Quarantined RAG chunks.
• Pending approvals.
• Open incidents.
• Degraded-mode events.
• Average latency.
• Timeline events across scanner, DLP, RAG firewall, runtime, tools, and red-team runs.

Local-first defaults

• SECURITY_OPS_ENABLED=true by default.
• Views use redacted previews and audit-safe metadata.
• Raw prompts, documents, tool arguments, and model outputs are not shown by default.
• Tenant filtering should be used when multiple apps or teams share one deployment.

Review incidents

Open the Operator App:

http://localhost:8000/app/

Use Security Ops to triage incidents by severity, status, source component, attack type, and assignee. Evidence should show event IDs, hashes, reason codes, and redacted summaries.

Review approvals

Agent and tool actions that require approval appear in the approval queue. Approving one action should bind to that exact tenant, session, trace, tool name, and canonical tool-call hash. Approval of one action must not authorize a different action.

API

GET  /v1/security/ops/overview
GET  /v1/security/ops/incidents
POST /v1/security/ops/incidents
PUT  /v1/security/ops/incidents/{incident_id}
GET  /v1/security/ops/approvals
GET  /v1/security/ops/timeline
GET  /v1/security/ops/top-risks
GET  /v1/security/ops/policy-suggestions

Security Ops is not a SIEM replacement. It is an AI-specific operating surface for Firefish decisions and evidence.