johannes
930a4b968e
4-tier ladder customer<internal<dev<bcos. Re-tagged Architect/Testing/Claude + platform/technical from internal->dev; Processes stays bcos. Backend visible() enforces a per-instance served-audiences cap at the API. bcos.dev/DLX serve all; production sets GUIDE_SERVED_AUDIENCES=customer,internal so dev/bcos never leave dev. Verified: capped instance returns only Customer+Internal, 404s dev/bcos. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.2 KiB
2.2 KiB
module, title, tab, order, audience
| module | title | tab | order | audience |
|---|---|---|---|---|
| aria.dashboard | Threat Dashboard | Testing | 35 | dev |
Frontend test checklist for the ARIA Threat Dashboard (aria.bcos.dev) — the landing screen of the ARIA SPA. Click through in the UI and mark each row Pass or Fail.
Set up
Log in at aria.bcos.dev — test accounts (all password Passw0rd-d3v!):
| Login | Role | Sees |
|---|---|---|
bcos_a@bcos.dev |
Admin | Full ARIA dashboard (BCOS_ADMIN only) |
msp_a@msp1.bcos.dev |
MSP admin | No access — dashboard fails to load |
customer_a@customer1.bcos.dev |
Customer | No access — dashboard fails to load |
The cards are fleet-wide totals built from the simulator devices (C1-ATM-001…, C1-TCR-001…, and C2-/C3- for the other institutions). The dashboard loads once on open — there is no refresh button, so reload the page to re-pull numbers.
What to test
| # | Do this | ✅ Pass if |
|---|---|---|
| 1 | As bcos_a, open the ARIA Dashboard |
Page loads with header ARIA Dashboard and three sections: Threat Activity, Compliance, Phase Coverage — cards show numbers, no "Load Failed" toast |
| 2 | Look at the Threat Activity cards | Four cards visible: Total Events, Critical, High, Active Sequences |
| 3 | Click the Critical card | Jumps to the events list filtered to critical events |
| 4 | Click the High card | Jumps to the events list filtered to high events |
| 5 | Click Active Sequences | Opens the Precursor Alerts / sequences view |
| 6 | Click Active IOCs | Opens the IOC Management view |
| 7 | Click Low Posture (and EOL Devices) | Opens the Device Posture view |
| 8 | Try clicking Total Events and Non-Critical Events | Nothing happens — these two cards are not clickable (no hover lift, no navigation) |
| 9 | Scroll to Phase Coverage | Shows five reference rows: Physical Access, Malware Staging, Malware Execution, Persistence, Cleanup — each with a description |
| 10 | Log in as msp_a, then customer_a, open the dashboard |
Both see a "Could not load ARIA stats" error toast with empty/no cards — ARIA is admin-only |
Report a fail with: the row #, which login you used, and what you actually saw.