Core entities
Search and module states
- Search status
- Module delivery
- Panel updates
Typical status flow:
pendingrunningfinishederror
Visibility rules
A field, tab, or panel is displayed only when all required conditions are met:- The search type supports that view
- The plan allows the underlying data source
- Matching data is present in returned payloads
- The user has not disabled the view in display settings
Missing panel usually means no applicable data was returned, not a rendering issue.
Relationships in practice
Search -> Module Results
Search -> Module Results
One search execution yields multiple module outputs (stream events and/or stored cards).
Search -> Result payload
Search -> Result payload
One search can include cards plus optional leaked, breached, and registered account datasets in its stored result payload.
Organization -> Searches and tool results
Organization -> Searches and tool results
An organization owns searches and saved tool results launched while it is selected. The launching member remains recorded as the creator.
Legacy Team -> Projects -> Searches
Legacy Team -> Projects -> Searches
Legacy Teams group projects, and projects can reference saved searches, notes, and attachments. They do not overlap with organization scope.
Monitor → Alerts
Monitor → Alerts
Monitoring alerts have severity and workflow status; see Monitoring & Alerts.