Accessing the Platform and Home
Accessing BlueRock
After completing the BlueRock installation and setup, access the BlueRock platform using the dashboard URL provided for your deployment.
Use the following format:
https://<dashboard-hostname>/home
For example:
https://<dashboard-hostname>/home
Note: Replace
<dashboard-hostname>with the hostname configured for your BlueRock deployment.
Open the URL in a supported web browser to access the BlueRock dashboard.
Home
After accessing BlueRock, the Home page provides a high-level view of activity across the platform.
The Home page provides different views for operational activity, security, policy, cost, and investigation-related information. Use the view selector at the top of the page to switch between these areas.
Home Navigation
The Home page includes the following primary views:
Ops - Provides an operational view of activity across hosts, sessions, MCP interactions, and tool calls.
Security - Provides a security-focused view of policy violations, alerts, rules, and findings.
Cost - Provides cost and token usage information.
Policy - Provides policy activity, violations, rollout status, and policy synchronization information.
Investigate - Provides investigation-related activity and scheduled investigations.
A time-range selector is available at the top-right of the page. The screenshots show the selected range as Last 1 hour.
Operations View
Select Ops to view operational activity.
The Operations view provides an Operational pulse containing activity metrics for the selected time range.
Operational Pulse
The Operational pulse displays the following metrics:
Active Hosts
Fleet-wide count of active hosts tracked by the HRAMP digital twin.
Active Sessions
Number of currently active MCP sessions between MCP clients and MCP servers.
MCP Interactions
Number of MCP interactions
MCP P95
P95 value for MCP interactions
Tool Calls
Number of tool calls
Tool P95
P95 value for tool calls
The values and trend information shown in these cards reflect the selected time range.
Operational Activity
The Operations view also displays summary information for the following entities:
Agents
Agents associated with the environment.
Servers
Servers associated with the environment.
Tools
Tools available or used within the environment.
Alerts
Alerts generated for the environment.
Events
Events recorded for the environment.
Users
Users associated with the environment.
Rule Firings
The Rule firings · ops section lists rules that have fired during the selected time range.
A rule firing represents an alert raised when the value observed for a rule crosses its configured threshold. The value used for comparison may be an instantaneous value, a deviation from a rolling baseline, a trend, or a forecast.
Click a rule-firing row to open the rule definition.
The table includes:
When the rule fired
Rule
Severity
Message
Value
Anchor
Event Timeline
The Event Timeline displays recent events associated with the environment.
Each event can include:
Event name
Severity
Host or related entity
Event timestamp
Use Refresh to update the timeline or View all events to access the complete event list.
Security View
Select Security to view security-related activity.
The Security view provides a Security pulse containing security metrics for the selected time range.
Security Pulse
The Security pulse displays metrics including:
Policy Violations
Number of policy violations
Permission Decisions
Permission decisions recorded
Unknown Identities
Identities that could not be identified
Security Summary
The Security view also provides summary cards for:
Active alerts
Policy violations
Security rules firing
Users
Violations and Triggers by Rule
The Violations & triggers by rule section provides a rule-level view of security activity.
The table includes:
Severity
Rule or policy
Alerts
Events
Latest occurrence
Rule Firings
The Rule firings · security section lists security rules that have fired during the selected time range.
A rule firing represents an alert raised when the value observed for a rule crosses its configured threshold. The value used for comparison may be an instantaneous value, a deviation from a rolling baseline, a trend, or a forecast.
The section displays rule-firing information for the selected time range.
Rule firings may appear within approximately five minutes of the observed firing.
Cleared alerts are not displayed.
For firings associated with a specific user or team, an identity indicator is displayed.
Policy View
Select Policy to view policy-related activity.
The Policy view provides a Policy pulse containing policy metrics for the selected time range.
Policy Pulse
The Policy pulse displays the following metrics:
Policy violations
Number of policy violations detected.
Active hosts
Fleet-wide count of active hosts tracked by the HRAMP digital twin.
Policy Lifecycle Summary
The Home page provides summary counts for policies in different lifecycle states:
Drafts
In review
Approved
Deployed
These cards provide a high-level view of the current policy lifecycle.
Rollout Health
The Rollout health section provides information about policy decisions and rollout status.
Fleet Policy Sync
The Fleet policy sync section provides an overview of policy synchronization across hosts.
The section includes information such as the following:
Host
Host associated with the policy synchronization.
Last sync
Most recent policy synchronization time.
Status
Current policy synchronization status.
Cycles
Total number of policy lifecycle events for the host.
Active policy
Policy currently active on the host.
Failure events
Number of policy lifecycle events that failed during the selected time range.
Latest error
Error from the host's most recent failed policy synchronization cycle.
Recent Policy Lifecycle
The Recent policy lifecycle section displays individual policy lifecycle events, including successful and failed events, with the event name and error information.
Cost View
Select Cost to view cost and token-related information.
The Cost view provides a high-level summary of spending and token usage for the selected time range.
Cost Summary
The Cost view displays:
Estimated Spend
Tokens
Projected
Estimated Spend and Tokens are populated based on actual LLM traffic. The values are calculated using hourly data, so allow up to approximately one hour after the first LLM traffic is received for the figures to stabilize.
Note: Deployment alone does not populate Estimated Spend or Tokens. Actual LLM traffic is required.
Projected provides a forecast for the next 6h.
The forecast excludes cache reads and cache writes.
Note: The Projected value may not be available immediately while the system is warming up. When applicable, the Home page displays the following message:
“Warming up — forecasting needs sustained token traffic to fit a trend”
Top Consumers
The Top consumers section provides cost information by consumer.
The table includes:
Consumer
Spend
Tokens
Change compared with the prior period
Rule Firings
The Rule firings section lists rules that have fired during the selected time range.
A rule firing represents an alert raised when the value observed for a rule crosses its configured threshold. The value used for comparison may be an instantaneous value, a deviation from a rolling baseline, a trend, or a forecast.
Click a rule-firing row to open the rule definition.
The table includes information such as:
When the rule fired
Rule
Severity
Message
Value
Anchor
Rule firings may appear within approximately five minutes of the observed firing.
Cleared alerts are not displayed.
For firings associated with a specific user or team, an identity indicator is displayed.
Use Open Cost Management to navigate to the detailed Cost Management page.
Use A2M analytics to access Agent-to-Model analytics.
Investigate View
Select Investigate to view investigation-related activity.
The Investigation view provides an Investigation pulse for the selected time range.
Investigation Pulse
The Investigation pulse displays:
MCP Interactions
Tool Calls
Median Session
Active Agents
Scheduled Investigations
Scheduled Investigations
The Scheduled investigations section provides space for configured investigation targets.
Each available slot can be used to Register a target.
Select Manage to manage scheduled investigations.
Flagged Alerts
The Flagged alerts section displays alerts that require investigation or attention.
The table includes:
Severity
Trigger
Host
When
The page indicates that alerts are ordered with the highest severity first.
Recent Sessions
The Recent sessions section displays recent session activity.
Use Open graph explore to navigate from the Home page to Graph Explorer for further exploration.
Time Range
The Home page includes a time-range selector in the upper-right corner.
The screenshots show Last 1 hour as the selected time range.
The metrics and activity displayed on the Home page correspond to the selected time range.
Navigating to Detailed Views
The Home page provides a high-level view of activity. Use the navigation options and links available on the page to move to detailed areas of BlueRock.
The detailed documentation for these areas is covered in their respective topics:
Last updated