Activity feed + What's new

What it is

Two related views that surface “what happened recently”:

• Activity feed: the audit trail, reverse-chronological. Every privileged action (target add, target delete, AI run start, agent revoke, plan change) with actor + timestamp + scope.
• What’s new, the surface-change feed: new hosts appearing, services flipping live ↔ gone, new findings, new KEV listings on existing services. Filterable by time window (24 h, 7 d, 30 d).

What it produces

• Per row: timestamp, event type, actor (user or system), affected scope, jump-to-detail link
• Time-windowed roll-ups: “127 new services discovered in the last 24 h, 4 critical findings, 1 KEV”
• Per-target activity sub-feed: open any target, see only events scoped to it

What to use it for

• Standup: “what changed since yesterday?” Exact answer in 5 s
• Incident response: “when did this service first appear?”
• Compliance evidence: “show me every privileged action in Q3”

Why it matters

The activity feed is the security version of git log, the single most-loadbearing investigative tool you have. “What’s new” in particular is what turns Umbra from a one-time scanner into a monitoring product.

Why it’s valuable

• Two feeds, two purposes. Audit log for who-did-what; what’s- new for what-changed. Don’t confuse them.
• Token-filterable. Same SmartSearch grammar: actor:alice, type:service_appeared, type:agent.proxy_http.create, etc.
• Per-target scope. Each target has its own activity tab so you don’t have to filter the global feed.

How to use it

• Activity in the left nav → global audit log.
• What’s new in the top bar → surface-change feed.
• Open any target’s detail page → Activity tab → that target’s events only.

For Slack: subscribe a channel to specific event types via notification rules.