---
module: aria.dashboard
title: Threat Dashboard
tab: Testing
order: 35
audience: dev
---

Frontend test checklist for the **ARIA Threat Dashboard** (`aria.bcos.dev`) — the landing screen of the ARIA SPA. Click through in the UI and mark each row Pass or Fail.

## Set up
Log in at **aria.bcos.dev** — test accounts (all password `Passw0rd-d3v!`):

| Login | Role | Sees |
|-------|------|------|
| `bcos_a@bcos.dev` | Admin | Full ARIA dashboard (BCOS_ADMIN only) |
| `msp_a@msp1.bcos.dev` | MSP admin | **No access** — dashboard fails to load |
| `customer_a@customer1.bcos.dev` | Customer | **No access** — dashboard fails to load |

The cards are fleet-wide totals built from the simulator devices (**C1-ATM-001…**, **C1-TCR-001…**, and C2-/C3- for the other institutions). The dashboard loads **once on open** — there is no refresh button, so reload the page to re-pull numbers.

## What to test

| # | Do this | ✅ Pass if |
|---|---------|-----------|
| 1 | As `bcos_a`, open the **ARIA Dashboard** | Page loads with header **ARIA Dashboard** and three sections: **Threat Activity**, **Compliance**, **Phase Coverage** — cards show numbers, no "Load Failed" toast |
| 2 | Look at the **Threat Activity** cards | Four cards visible: **Total Events**, **Critical**, **High**, **Active Sequences** |
| 3 | Click the **Critical** card | Jumps to the events list filtered to critical events |
| 4 | Click the **High** card | Jumps to the events list filtered to high events |
| 5 | Click **Active Sequences** | Opens the Precursor Alerts / sequences view |
| 6 | Click **Active IOCs** | Opens the IOC Management view |
| 7 | Click **Low Posture** (and **EOL Devices**) | Opens the Device Posture view |
| 8 | Try clicking **Total Events** and **Non-Critical Events** | Nothing happens — these two cards are **not clickable** (no hover lift, no navigation) |
| 9 | Scroll to **Phase Coverage** | Shows five reference rows: Physical Access, Malware Staging, Malware Execution, Persistence, Cleanup — each with a description |
| 10 | Log in as `msp_a`, then `customer_a`, open the dashboard | Both see a **"Could not load ARIA stats"** error toast with empty/no cards — ARIA is admin-only |

**Report a fail with:** the row #, which login you used, and what you actually saw.
