---
module: aria.threat-events
title: Threat Events
tab: Testing
order: 35
audience: dev
---

Frontend test checklist for **Threat Events** (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.

## Set up
Log in at **aria.bcos.dev** — test accounts (all password `Passw0rd-d3v!`):

| Login | Role | Sees |
|-------|------|------|
| `bcos_a@bcos.dev` | Admin | Full Threat Events list (all institutions) |
| `msp_a@msp1.bcos.dev` | MSP admin | **No access** — Threat Events is admin-only |
| `customer_a@customer1.bcos.dev` | Customer | **No access** — Threat Events is admin-only |

Threat Events is a **read-only** screen — there is nothing to create, edit, or delete. Rows are detected events across the simulator fleet (devices like **C1-ATM-001**, **C1-TCR-001**, C2-/C3- for the others).

## What to test

| # | Do this | ✅ Pass if |
|---|---------|-----------|
| 1 | As `bcos_a`, open **Threat Events** | Table loads with columns **Severity · Signal · Device · Attack Phase · IOC Match · Detected**, newest at top, and a count like "N events" in the toolbar |
| 2 | Open the **Filters** sidebar (▶) and pick **Severity → CRITICAL** | List narrows to only **CRITICAL** rows, a **Severity: CRITICAL** tag appears above the table, and the count drops |
| 3 | Click **✕ Clear all** in the Filters sidebar | All filters and tags clear and the full list comes back |
| 4 | With severity set to **All**, copy a **Device** value from any row into the Filters **Device ID** box | After a moment the list shows only that device's events and a **Device: …** tag appears (clear the Severity filter first, or the device box is ignored) |
| 5 | Toggle **Auto-refresh** off (top-right) | The countdown stops and the label reads just **Auto-refresh** (no `(60s)`); toggling it back on resumes the countdown |
| 6 | Click the **↻ refresh** button | A brief **Loading…** shows and the list reloads with no error toast and no crash |
| 7 | If there is more than one page, use the pager to go to page 2 | A different set of rows loads and the page indicator updates |
| 8 | Log in as `msp_a`, open **Threat Events** | You do **not** see the list — an empty screen or a **"Could not load threat events"** error toast (admin-only; this is expected) |
| 9 | Log in as `customer_a`, try **Threat Events** | Same as above — **no threat events are shown** (customer has no access) |

**Report a fail with:** the row #, which login you used, and what you actually saw.
