> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Web UI

> A web dashboard for managing alerts, configuring integrations, and monitoring your Calseta instance.

Calseta includes a web UI at [http://localhost:5173](http://localhost:5173) for visual alert management and platform configuration. The UI is built with React and Vite.

<Info>
  The UI is optional — every action is also available via the [REST API](/api-reference/overview) and [MCP server](/mcp-reference/overview). The UI uses the same API endpoints under the hood.
</Info>

## Alerts

<Frame>
  <img src="https://mintcdn.com/calseta/6xZ9bwwniHmrG7R3/images/ui-alert-list.png?fit=max&auto=format&n=6xZ9bwwniHmrG7R3&q=85&s=12c953dbe406c5a05d4b076f56f29bb9" alt="Calseta UI — Alert list with severity, status, and enrichment indicators" width="1904" height="640" data-path="images/ui-alert-list.png" />
</Frame>

The alert list view shows all ingested alerts with their severity, status, enrichment status, and source. Click any alert to see the full detail view.

### Alert Detail

<Frame>
  <img src="https://mintcdn.com/calseta/6xZ9bwwniHmrG7R3/images/ui-alert-detail.png?fit=max&auto=format&n=6xZ9bwwniHmrG7R3&q=85&s=021dd991da439b9be6c0ba20988a3f04" alt="Calseta UI — Alert detail with indicators, enrichment results, and context" width="1897" height="852" data-path="images/ui-alert-detail.png" />
</Frame>

The alert detail view includes:

* **Alert metadata** — title, severity, status, source, timestamps
* **Indicators** — extracted IOCs with malice verdicts and enrichment results
* **Enrichment results** — per-provider breakdown (VirusTotal, AbuseIPDB, etc.)
* **Context documents** — matched runbooks and SOPs
* **Activity timeline** — audit log of all actions taken on the alert
* **Relationship graph** — visual map of indicator relationships across alerts

## Navigation

The sidebar is organized into three sections:

### Main

* **Dashboard** — overview metrics and recent activity
* **Alerts** — alert list and detail views
* **Workflows** — workflow code, execution history, and approval settings
* **Approvals** — pending and resolved approval requests

### Manage

* **Agents** — register and manage agent webhook endpoints with trigger filters
* **Enrichments** — configure builtin and custom enrichment providers, view status, test against sample indicators. The **Field Extractions** tab on each provider's detail page manages which fields from raw API responses are surfaced to agents.
* **Detection Rules** — view and edit detection rules with MITRE ATT\&CK mappings and documentation (auto-created when alerts arrive)
* **Context Docs** — upload and manage runbooks, IR plans, and SOPs with targeting rules

### Settings

* **API Keys** — create and manage API keys with scoped permissions
* **Alert Sources** — configure alert source integrations and webhook endpoints
* **Indicator Mappings** — manage indicator field extraction mappings (system-seeded normalized mappings and custom per-source mappings against raw payloads)

## Access

The UI runs as a separate dev server during local development:

```bash theme={null}
cd ui && npm install && npm run dev
```

When using `make dev` or `make lab`, the UI server starts automatically.

<Tip>
  For production deployments, build the UI as static assets with `cd ui && npm run build` and serve them via your preferred web server or CDN.
</Tip>