AegisCommand

Service Health

API healthUnknown

API readinessUnknown

Operating modeMonitor + enforce

Provider Admin

Agent health, alert volume, enforcement state, tenant risk, and host reports

Sources with unresolved alerts-No unresolved alerts

Unresolved critical sources-No unresolved critical alerts

Enforcement queue-No pending actions

Recent telemetry-Agent events in view

Agent health-No agents reporting

Config sync-No desired config

Agent mail-No agent mail volume

Agent diagnostics-No diagnostics

Action Queue

Priority	Signal	Scope	Action

Tenant Risk

Tenant	Risk	Critical	Alerts	Traffic

Managed-Service Access

Role	Scope	Permissions	Troubleshooting	Status

Agent Infrastructure

Node	Status	Mode	Version	Last Seen

Agent Reports

Agent	Role	Config	Telemetry	SMTP / Direction	Action

Agent Diagnostics

State	Count	Hosts	Next step

Agent Source Diagnostics

State	Source	Destination	Agent	Evidence	Next step

Operations Snapshot

Agents online: -
Hosted source ranges: -
SMTP limiters: -
Audit events: -

Customer Portal

Legacy customer mail controls are retired from monitor-only operation

Delivery rate-No delivery data

Sender domains-Observed and policy-scoped domains

Suppressions-Blocked recipients, senders, and domains

Quarantine-Held or suspicious submissions

Alerts-Tenant-scoped security signals

Usage-Total messages in current view

Sender Domains

Domain	Messages	Delivery	Verification	Policy

SMTP and API Access

Type	Name	Scope	Status	Controls

Suppression Lists

Target	Scope	Action	Status	Reason

Quarantine

Message	Verdict	Score	Release	Created

Delivery Logs

Status	Message	Sender	Recipient	Logged

Alerts

Severity	Type	Scope	Description	Created

Usage

Metric	Total	Delivered	Deferred	Failed

IP Policies

Configured monitoring, ownership, whitelist, block, and rate-limit state

Pending operations-Firewall changes awaiting agents

Ready for agent-Host can pull now

Waiting for host-Host setup or heartbeat needed

Enforce changes-Pending changes that alter firewall state

Configured IPs

Exact hosted IPs stay actionable here for whitelist changes. Normal monitored subnets stay in Advanced Inventory.

IP or subnet Owner Agent Policy

Showing all configured IP policies.

IP / Subnet	Owner	Agent / VM	Monitoring	Enforcement	Updated	Actions
No configured IP policies loaded.

Block SMTP Source

Preview or queue a single source IP/range block after ownership is clear.

Find Source

Search recent agent and hosted inventory sources.

Source	Owner / Host	Activity	Action
No sources loaded yet.

Dry-run preview and queued source-IP SMTP blocks list exact action, target, port, and command previews here.

Hosted Outbound Inventory

This is the owner map for provider-hosted IPs. Add one IP or subnet per VPS, VM, customer block, or routed range so AegisMX can show which server traffic is headed to, attribute outbound SMTP to the right customer, and decide whether SMTP abuse actions are allowed.

What this controls Source ownership, agent/node assignment, VM labels, abuse contact, and whether the IP is in scope for SMTP abuse blocking or rate-limit decisions.

Use the form first Pick an existing row to edit, or enter a new IPv4/IPv6 address or CIDR. Attribution gaps can load this form with observed host and VM evidence.

Bulk import is optional Use Bulk import only when pasting many rows from Proxmox, WHMCS, IPAM, or a reviewed attribution worklist.

No bulk import preview loaded.

Action	Range	Owner / Host	Changes	Warnings
Paste bulk owner rows and preview before committing an import.

Incomplete Source Attribution

Agent telemetry found hosted-looking SMTP sources missing inventory, owner, host, or VM details. Load one into the form, review the suggested evidence, then save the authoritative source record.

No incomplete source attribution loaded.

Source	Observed Host	Activity	Missing	Action
No incomplete source attribution loaded.

Range	Owner	VM	Activity	Status	Updated	Edit

Pending Agent Actions

Firewall changes waiting for the assigned agent

Action	Agent	Target	Effect	Readiness	Technical details	Queued	Review

Agents

Current agent version: -

Workflow

Install separately. Manage from the table.

Use install/update for commands and tokens. Use monitor/manage to edit desired config, review direction counts, and open evidence views.

Total: -
Online: -
Needs setup: -

Monitor / manage

Manage Existing Agents

Edit desired config, open agent activity, jump to the abuse workbench, and copy the update command when an agent is behind the current version.

Agent Logs

Recent events from all agents

Time / Agent	Source / Route	Event	Result

Agent ID Host role Agent mode Heartbeat seconds Telemetry seconds Enforcement seconds SMTP spike threshold Auto-update when current version is available Allow local enforcement on this host (Full control only) Hosted outbound IPs/subnets

Selected ranges are shown first; available inventory rows are shown below. Add rows this host should treat as outbound VPS/customer sources. Remove clears the range from this agent and this host assignment in inventory.

Add hosted IP/subnet to this host Creates or updates a Hosted Outbound Inventory row for this agent node, selects it here, then you can save the agent config.

Use this only when changing the host role or moving every hosted range to another host.

Local interface addresses Addresses on the router/hypervisor itself. This helps classify routed SMTP as inbound, outbound, or unknown.

Host firewall

Live SMTP Limiter

AegisWatch reads the running SMTP25-LIMIT chain and counters. Live / imported means the host is enforcing the policy but AegisMX has not applied it yet. Live / AegisMX means a completed agent apply owns the same chain.

No host SMTP limiter policy loaded.

Host	Policy	Standard sources	High-rate sources	Bypass	Action
No live host SMTP limiter policies reported yet.

Line	Packets	Bytes	Target	Source	Options	Policy Edit
No live SMTP limiter snapshot reported yet.

Recent limiter activity

Policy edits are separate from live import. Use the live policy list above first. Open the editor only to change trusted IPs, high-rate exceptions, or limits before dry-run/apply.

Agent	Role & Config	Version / Update Policy	Health	Activity (1h)	Actions

Alerts

Alerts are qualifying policy or threshold incidents, not ordinary below-threshold observations. Archive an alert after review to hide it from this default Unresolved view while preserving its history. Activity totals below always show their observation window.

	Severity	Source	Detection history	Alert record status	Latest signal	Action

Operator & Security Audit

Configuration, access, and enforcement changes; routine agent ingestion stays in Agent Log

Event	Actor	Resource	Created

Users and Tenants

Edit provider-managed users, customer tenants, and archived records

Tenants

Customer identity, plan, primary domain, and archive state

Tenant	Customer	Domain	Plan	Status	Notes	Updated	Actions

Users

Role, tenant scope, setup email, MFA state, and archive state

User	Email	Role	Tenant	Security	Status	Notes	Updated	Actions

Configuration

Checking setup state

Global SMTP Abuse Policy

Global thresholds and automation scope for outbound SMTP abuse. Agent-specific enforcement mode, hosted ranges, local addresses, SMTP whitelist, and live limiter rules are managed from the individual agent.

Traffic

Source IP, subnet, provider, relay node, queue state

Severity	Signal	Scope	Count	Rate	Recommendation

Severity	Recommendation	Scope	Evidence	Action

By Source IP

Source IP	Total	Queued	Delivered	Deferred	Bounced	Action

By Sender

Sender	Total	Queued	Delivered	Deferred	Bounced

By Domain

Domain	Total	Queued	Delivered	Deferred	Bounced

By Provider

Provider	Total	Queued	Delivered	Deferred	Bounced

By Relay Node

Node	Total	Queued	Delivered	Deferred	Bounced

Tenants and Mail Modes

Configure tenant mail behavior, transparent relay mode, policy enforcement, and release workflow

Current tenant-Top-bar organization context

Mail mode-Transparent or enforcement preset

Policy-Dry-run or enforce

Release-Quarantine workflow

Tenant Mail Modes

Create, test, import, or export tenant mail-mode templates without leaving the saved-mode table.

Saved tenant mail modes

Current templates, selected behavior, delivery profile, and edit actions.

Tenant	Template	Type	Protection	Policy	Controls	Delivery	Rate	Status	Actions

Sign in

Service Health

Provider Admin

Action Queue

Tenant Risk

Managed-Service Access

Agent Infrastructure

Agent Reports

Agent Diagnostics

Agent Source Diagnostics

Operations Snapshot

Customer Portal

Sender Domains

SMTP and API Access

Suppression Lists

Quarantine

Delivery Logs

Alerts

Usage

IP Policies

Configured IPs

Block SMTP Source

Find Source

Hosted Outbound Inventory

Incomplete Source Attribution

Pending Agent Actions

Agents

Install separately. Manage from the table.

Install Or Update Agent

Manage Existing Agents

Agent Logs

Host SMTP Limiters

Source Review

Source Detail

Alerts

Alert

Operator & Security Audit

Users and Tenants

Impersonation

Tenants

Users

Configuration

Global SMTP Abuse Policy

My Settings

Account Settings

Docs

Current Operating Model

Traffic

By Source IP

By Sender

By Domain

By Provider

By Relay Node

Tenants and Mail Modes

Tenant Mail Modes

Saved tenant mail modes