Core entities
Search and module states
- Search status
- Module delivery
- Panel updates
Typical status flow:
pendingrunningfinishederror
Visibility rules
A field, tab, or panel is displayed only when all required conditions are met:- The search type supports that view
- The plan allows the underlying data source
- Matching data is present in returned payloads
- The user has not disabled the view in display settings
Missing panel usually means no applicable data was returned, not a rendering issue.
Relationships in practice
Search -> Module Results
Search -> Module Results
One search execution yields multiple module outputs (stream events and/or stored cards).
Search -> Result payload
Search -> Result payload
One search can include cards plus optional leaked, breached, and registered account datasets in its stored result payload.
Team -> Projects -> Searches
Team -> Projects -> Searches
Teams group projects, and projects can reference saved searches, notes, and attachments.
Monitor -> Alerts
Monitor -> Alerts
One monitor can generate many alert records over time, each with its own workflow status.