Field narrative
Four-stop flow for design partners — links jump straight into the console surfaces that engineers will extend against real collectors. Use ⌘K for quick navigation anywhere.
SOC analyst
Prioritize noisy listeners and identity deltas.
SRE / platform
Verify baselines after change windows and scan coverage.
Step 1
Establish baseline
Pin an approved snapshot after change freeze — /baselines · /onboarding.
Step 2
Run fleet integrity scan
Use Run scan — routes through POST /api/v1/scans with live polling when mock mode is off.
Step 3
Triage drift
Open /drift, investigate drawer, acknowledge or approve with operator/admin roles.
Step 4
Export evidence
Evidence meta + artifact stubs under /api/v1/evidence/bundles/:id (+ /file).
Bookmarkable queries aligned with drift lifecycle filters and demo flows.