Real-Time Notifications & Dashboard Updates
Pages refresh on their own as syncs, alerts and risk changes arrive, and the notification bell collects the events that need a person.
Requires role: Operator or Admin (live page updates, the notification bell and the Notifications page)
Related: Risk Posture Dashboard, Detection Alerts, Critical Junctions, Cross-Tier Credential Exposure, Identity Bridge, Full-Automated Execution
Overview
GraphnAI sends activity to your browser as it happens. When a sync finishes, an alert fires or the risk score changes, the pages that show that data refresh themselves. You don't need to reload.
Two features work together:
- Live page updates: your browser keeps a connection open to the server. When data behind the page you're on changes, the browser fetches only the affected panels again.
- Notifications: the bell in the top bar counts your unread notifications. Critical detection alerts, risk score jumps and automatic-action events each create one. The Notifications page lists them all.
Both work for Operators and Admins as soon as you sign in. There's nothing to set up.
Prerequisites
- Role: Operator or Admin.
- A signed-in session: the browser opens the live connection when the app loads.
- Data: at least one directory sync must have finished. Until then there's no activity to report.
NOTE
The live connection uses your existing session. It needs no extra credentials, API keys or firewall rules beyond normal access to GraphnAI.
How Live Updates Work
While the app is open, the server sends a short signal each time something changes. Your browser then refreshes the panels that show that data:
| When this happens | These refresh |
|---|---|
| A directory sync finishes, full or delta | Risk posture, the dashboard, identity inventory, platform health, sync status and history, detection alerts, and analysis status |
| A sync makes progress | Sync status, history and phase |
| A domain's relationships finish building | The graph and the dashboard |
| A detection alert is created | The Detection Alerts table and detail, the alert count in the sidebar, and the dashboard |
| Analysis finishes, after a full sync or a delta sync with changes | Risk posture, the dashboard, over-permission findings, identity inventory, delegation posture, security posture and analysis status |
| The risk score changes | The risk score, its trend history and the dashboard |
| A posture check changes | Security posture, identity inventory, risk posture and its history, and the dashboard |
| A notification is created for you | The notification list and the unread count |
| AI provider health changes (Admins) | AI provider health |
| Telemetry counts change (Admins) | Telemetry statistics |
A panel briefly shows its loading state while it refreshes.
Connection status
A badge in the top bar shows the live connection's state. Hover it for details.
| Badge | What it means |
|---|---|
| Live | Pages update as new activity arrives. |
| Reconnecting | The connection dropped and is coming back. The tooltip shows when it last connected. |
| Offline | Live updates are disconnected. Refresh the page if this continues. |
The badge stays hidden while the first connection opens. When the connection drops, the browser reconnects by itself. The server keeps the last 5 minutes of activity and replays it on reconnect, so your pages catch up. After a longer gap, refresh the page.
If the connection fails three times within 30 seconds, a "Live updates disconnected" message appears, and the browser keeps retrying. If the browser gives up, the message reads "Live updates stopped. Refresh the page to reconnect."
Using the Notification Panel
The notification panel opens from the bell icon in the top bar.
Unread count
When you have unread notifications, a red badge on the bell shows how many, up to "99+". The bell is filled while you have unread notifications and outlined when you have none.
Opening the panel
Select the bell to open the panel. The header shows Notifications and how many are unread. The panel lists your 10 most recent notifications. Each one shows:
- Title: what happened, for example "Critical detection alert".
- Message: a sentence naming the account, the change or the score.
- Severity: a Critical, Warning or Info badge.
- Type: for example "Detection alert" or "Risk score".
- Time: how long ago it arrived, for example "2m ago" or "3h ago".
- Unread dot: a blue dot beside the title of an unread notification.
Select View all notifications → at the bottom to open the Notifications page.
Acting on a notification
- Open it: select a notification to mark it read and go to the related page. A detection alert opens that alert. A risk score change opens the dashboard. A remediation event opens the action on the Remediation page, and Full-Auto paused opens Admin > AI Provider.
- Mark all as read: select it in the panel header. It appears only while you have unread notifications.
- Dismiss: hover a notification and select the X to delete it.
Notifications are personal. Reading or dismissing one changes only your own list.
The Notifications Page
Open it from View all notifications → in the panel. The bell in the top bar shows how many are unread.
- Filters: narrow the list by type (All types or one type), severity (All severities, Critical, Warning or Info), and All, Unread or Read. Clear filters resets them.
- Mark all as read: marks every notification read.
- Dismiss read notifications: deletes every notification you've read. Unread ones stay.
The page shows your latest 200 notifications. When you have more, it says "Showing the latest 200 of N". Notifications are deleted automatically 90 days after they arrive.
What Triggers Notifications
Each notification goes to every user with the role shown. You can't change these rules or thresholds.
| Notification | Severity | Who receives it | When |
|---|---|---|---|
| Critical detection alert | Critical | Operators and Admins | A detection alert with Critical severity is created. The message names the alert and the account, for example "DCSync from non-DC source on CORP\svc-backup." |
| Risk score rose | Warning | Operators and Admins | An analysis run raises the risk score by more than 10 points. The message gives the rise, the new score and the grade. |
| Closed-Loop Rollback undid a change | Warning | Operators and Admins | Closed-Loop Rollback undid a remediation action after failed sign-ins or failed services appeared on hosts that depend on it. |
| Remediation escalated | Critical | Operators and Admins | A remediation action needs review: an undo failed, a containment change caused failed sign-ins or failed services, or a change applied only some of its steps. |
| Full-Auto paused | Critical | Admins | 5 or more actions were undone, or escalations failed to send, within 10 minutes. Full-Auto stops, and actions wait for approval. |
| Change undone outside GraphnAI | Warning | Operators and Admins | Someone undid a verified change directly in the directory. |
NOTE
Three more rules aren't available yet, so they never fire: new access to a Tier 0 object, a rise in a Critical Junction score, and a stale Tier 0 or Tier 1 identity.
Troubleshooting
Notifications don't appear
- Check your role: only Operators and Admins receive notifications. A Viewer account has no bell.
- Check that a sync and its analysis have run: the risk score rule fires only after an analysis run. Analysis runs after each full sync and each delta sync with changes. Check Admin > Bridges to confirm a sync has finished.
- Check what triggers them: only the events in What Triggers Notifications create one. A High-severity detection alert doesn't.
Pages don't update on their own
- Check the badge in the top bar: Reconnecting or Offline means the live connection is down. Refresh the page.
- Check your session: an expired session can't open the live connection. Sign out, then sign in again.
- Check for a proxy: the live connection stays open for a long time, and some corporate proxies close long-lived connections. Try reaching GraphnAI without the proxy to confirm. Your network team can raise the proxy's timeout.
- After a long break: if you were away for more than 5 minutes, the replay doesn't cover the gap. Refresh the page.
The bell is missing
The bell appears only for Operators and Admins. If you don't see it, your account likely has the Viewer role. Ask an Admin to change your role if you need notifications.
The unread count doesn't go down
Open the panel and select a notification to mark it read. If the count still doesn't change, select Mark all as read in the panel header.