Security Control Center
One screen for security events raised across your workspace — boundary violations, suspicious access and risky API calls — with a triage state per incident so nothing is looked at twice or not at all.
The Security Control Center sits under Security in the left navigation. It is where security signals surface as incidents you can work through, rather than as lines buried in a log nobody reads.
What Raises An Incident
| Category | What it means |
|---|---|
| Tenant Boundary | An attempt to reach data belonging to another organization. Refused, and recorded. |
| Suspicious Access | Sign-in or access behaviour that does not match the account's normal pattern. |
| Risky API Call | An API request pattern worth a human look. |
Each incident carries a severity — critical, high, medium or low — and you can filter by category, severity, status or free text.
Working An Incident
An incident moves through four states: Open → Triaged → Resolved, or Ignored where it is understood and not worth chasing. Setting a state records who set it, so the queue reflects decisions rather than opinions. Ignoring is a decision on the record too — it does not delete the incident.
Who Can See And Act
- Viewing the control center needs its own permission.
- Changing an incident's status needs the incident management permission.
These are separate on purpose: a wider group can watch without anyone being able to quietly close things.
The Rest Of The Security Picture
- Device Trust — which devices and sessions are signed in, and how to cut one off.
- Audit Logs — the tamper-evident record of what was done.
- Login Activity under Security — sign-in history for your organization.
- MFA & Account Safety — the controls that prevent incidents in the first place.
Need help with this topic?
Capture the module, record number, branch or warehouse, user, visible message, and what you expected to happen before contacting support.