RocketCyber SOC Operations Console

What Is This Tool

Purpose, use cases, audience

The RocketCyber SOC Operations Console is a single-file HTML dashboard designed to give MSP technicians and SOC staff an at-a-glance view of all security data flowing through the RocketCyber platform. It consumes the RocketCyber Customer API v3 via a server-side proxy and renders three simultaneous data streams — incidents, agents, and app events — in a fixed-height three-column layout that fills the entire screen with no scrolling.

It is designed to operate as a NOC wall display, a standby screen during standup meetings, or an operations tab open alongside your PSA and RMM. Because the underlying API is read-only, this console is purely observational — it surfaces what RocketCyber's SOC has detected and reported. Remediation and isolation happen in the RocketCyber portal or via your PSA/RMM tooling.

Primary Use Cases

Architecture

Proxy pattern, data flow, CORS constraint

The RocketCyber API enforces CORS headers that block direct browser calls. All requests must originate from a server-side proxy that injects the Bearer token before forwarding to the RocketCyber API. The console never holds or exposes the token — it only calls paths on your own domain.

Data Flow Steps

1. 01
   Page Load — DOMContentLoaded

   The console fires rcLoadAll() immediately on DOM ready. Five parallel Promise.allSettled() calls go to your proxy — account, agents, apps, incidents, events.
2. 02
   Proxy Receives & Forwards

   Your server receives GET /proxy/rocketcyber/v3/agents?pageSize=1000, appends Authorization: Bearer {token}, and forwards to https://api-us.rocketcyber.com/v3/agents?pageSize=1000.
3. 03
   RocketCyber Returns JSON

   Each endpoint returns a JSON object with a data array. The proxy passes the response body back to the browser with no modification.
4. 04
   Console Populates All Panels

   rcRenderAll() runs once all five responses resolve. Rail counters animate, KPI tiles populate, the app coverage row renders, and the active view's table fills. The refresh bar then begins its 30-second countdown.
5. 05
   30-Second Auto-Refresh

   When the refresh bar depletes, rcRefresh() re-runs all five GET calls. Any selected row is re-bound to the refreshed data and the detail panel updates in place.

Console Layout

Full-viewport three-column NOC layout

The console uses a fixed full-viewport layout — no page scroll. The entire screen is divided into a rail at the top, a KPI row directly below, and a three-column working area that fills the remainder. Every column scrolls internally.

API v3 Overview

Base URI, authentication, rate limits, read-only nature

Authentication

RocketCyber API keys are generated in the RocketCyber portal under Provider Settings > RocketCyber API. The key is passed as a Bearer token in the Authorization header. It must never be embedded in the HTML file or exposed to the browser — your proxy layer holds it.

Authorization: Bearer YOUR_ROCKETCYBER_API_KEY

Pagination

All list endpoints support pageSize (max 1000) and page parameters. The console requests pageSize=1000 by default. For providers with more than 1000 agents or incidents, you will need to implement pagination in your proxy or use the allPages pattern documented in the API wrapper.

Endpoint Reference

All 7 API endpoints called by this console — field names from official documentation

Additional Endpoints (health monitoring only)

Field Value Enumerations

Exact allowed values per the API documentation — used by all filters and badges

agent.connectivity

Source endpoint: GET /v3/agents

incident.status

Source endpoint: GET /v3/incidents

event.verdict

Source endpoint: GET /v3/events?appId={n}

Rail & KPI Tiles

Top navigation bar and six-tile metric strip

The rail is a fixed 48px bar that persists across the full width of the screen. It contains the brand name, six animated counter stats, the demo mode indicator, a live clock, and the manual Refresh button.

Rail Counters

All six counters animate from their previous value to the new value on each refresh using a cubic-ease animation. They update live from the API data and are the fastest way to assess SOC health at a glance.

KPI Row (below rail)

Six tiles render directly below the rail, each showing a computed value, a label, and a context line. They use the same API data as the rail counters but present additional context (e.g. "12 online" as context for the Total Agents tile).

Incidents View

Default view — SOC-confirmed incidents from GET /v3/incidents

The Incidents view is the default view when the console loads. The center table shows all incidents sorted by createdAt descending (newest first). The left sidebar shows the open incident stream filtered to status=open for quick triage.

Status Filter Buttons

Three buttons control the statusFilter state variable. The filter applies client-side to the cached API data — no re-fetch occurs when changing filters.

Table Columns

Row Selection

Clicking any row sets it as RC.selected, re-renders the table to apply the .selected highlight class, and populates the right-hand detail panel with the full incident data including description, remediation notes, timestamps, account, and the API endpoint that sourced the data.

Agents View

All installed RocketCyber agents from GET /v3/agents

Switch to Agents using the view toggle in the left sidebar. The table shows all agents across all accounts. The connectivity filter buttons narrow the view to a specific state. Each row is left-bordered with the connectivity color for instant visual scanning.

Connectivity Filter Buttons

Maps to the connectivity field. Values are exactly online, offline, or isolated — no other values exist in this field per the API documentation.

Events View

App detection events from GET /v3/events — one record per detection

The Events view shows all events from all monitored apps, sorted by detection timestamp ascending (most recent first in the stream). Up to 100 rows render at a time for performance. The verdict filter buttons allow rapid scoping to malicious or suspicious events only.

Verdict Filter

Three values from the API — no others exist. Filtering is client-side against cached data.

Detail Panel

Right-hand panel — shows full API field data for the selected row

The detail panel populates when you click any row in the center table. It shows a different set of fields depending on which view is active. Every detail panel also shows the exact API endpoint that sourced the record and the allowed field values — so technicians always have the context they need without looking up the docs.

Incident Detail

Agent Detail

Shows agent ID, hostname, connectivity badge, accountName, accountId, IP address, OS, and agent version. The endpoint path shown is GET /v3/agents?id={agent-id}. A read-only note reminds that agent isolation is performed in the RocketCyber portal.

Event Detail

Shows verdict badge, app name, full detection detail text, event ID, app ID, accountName, accountId, and full ISO 8601 timestamp. The endpoint path shown includes the required appId parameter.

Action Bar

Four buttons at the bottom of the center column — all honestly scoped to read-only API

Local Test Package

Everything you need to run a local proxy and test against the real API — no Azure required

What's in the Package

First-Time Setup (Windows)

1. 01
   Install Node.js if not already installed

   Download the LTS version from nodejs.org. Run the installer with defaults. You only need to do this once per machine.
2. 02
   Unzip the package and open the folder

   Extract rc-proxy-local-test.zip to any location — your Desktop or Documents folder is fine.
3. 03
   Open .env and paste your token

   Open the .env file in Notepad. Replace paste-your-token-here with your actual RocketCyber API token. Save and close. See Section 15 for how to find your token.
4. 04
   Double-click START.bat

   A terminal window opens. On first run it installs the three npm packages (takes ~15 seconds). Then it starts the proxy and shows the test UI URL.
5. 05
   Open the test UI

   Navigate to http://localhost:3001/test-ui.html in your browser. The proxy health indicator at the top right will show green. Click any endpoint in the sidebar and hit Send.

Using the Test UI

Proxy Setup

Server-side proxy required — CORS prevents direct browser calls

The proxy's only job is to receive requests from the console, add the Bearer token header, and forward to RocketCyber. It should not log response bodies (which contain security event data) and should enforce origin restriction so only your console's domain can call it.

Node.js / Express Example

const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
const app = express();

// Bearer token stored in environment — never hardcoded
const RC_TOKEN = process.env.ROCKETCYBER_API_KEY;

app.use('/proxy/rocketcyber/v3', createProxyMiddleware({
  target: 'https://api-us.rocketcyber.com',
  changeOrigin: true,
  pathRewrite: { '^/proxy/rocketcyber/v3': '/v3' },
  onProxyReq(proxyReq) {
    proxyReq.setHeader('Authorization', `Bearer ${RC_TOKEN}`);
    proxyReq.setHeader('Accept', 'application/json');
  }
}));

app.listen(3001);

Nginx Example

location /proxy/rocketcyber/v3/ {
    proxy_pass         https://api-us.rocketcyber.com/v3/;
    proxy_set_header   Authorization "Bearer $ROCKETCYBER_API_KEY";
    proxy_set_header   Accept "application/json";
    proxy_hide_header  X-Powered-By;
}

Bearer Token

Where to find it, how to store it, rotation guidance

Finding Your Token

1. 01
   Log in to the RocketCyber Portal

   Navigate to app.rocketcyber.com and sign in with your Provider account credentials.
2. 02
   Open Provider Settings

   Click your account name or the settings gear in the top navigation to reach Provider Settings.
3. 03
   Navigate to RocketCyber API

   Find the "RocketCyber API" section within Provider Settings. The API key is displayed here. Full instructions: helpdesk.kaseya.com/hc/en-gb/articles/9239984991505
4. 04
   Copy and Store Securely

   Store in your proxy server's environment variable as ROCKETCYBER_API_KEY. Do not store in source control, HTML files, or client-side JavaScript.

Go-Live Checklist

Steps to activate the console against the real RocketCyber API

1. 01
   Generate API token in RocketCyber portal

   Provider Settings > RocketCyber API. Copy and store in your secrets manager or environment variable.
2. 02
   Deploy your proxy server

   Use the Node.js or Nginx pattern from Section 13. Confirm it responds to GET /proxy/rocketcyber/v3/account with a 200 and returns your accounts array.
3. 03
   Uncomment the production fetch block

   In the console's <script> block, locate the rcFetch() function. Uncomment the return fetch(endpoint, ...) block and remove the demo fallback return new Promise(...) block.
4. 04
   Update API_BASE constant

   If your proxy path differs from /proxy/rocketcyber/v3, update the const API_BASE constant at the top of the script block.
5. 05
   Verify all 7 endpoint health indicators go green

   Open the console. In the left sidebar under "API Endpoint Health", all seven rows should show green OK status. If any show ERR, check your proxy configuration and token validity.
6. 06
   Remove the Demo Mode pill from the rail

   In the HTML, find <span class="demo-pill"> in the rail and remove it. This prevents confusing live and demo data.
7. 07
   Set up origin restriction on the proxy

   Restrict proxy access to only requests originating from your console's domain. Add a CORS origin policy or HTTP Referer check.

PSA Integration

Wiring the Create Ticket button to ConnectWise or Autotask

The Create Ticket action in the console is wired to call /proxy/psa/tickets on your server. This is your own PSA proxy endpoint — not a RocketCyber API endpoint. You build this endpoint to translate a RocketCyber incident payload into whatever your PSA expects.

Payload Sent by Console

The console sends the full incident object as the request body. The relevant fields for ticket creation are:

ConnectWise Manage — Minimal Proxy Example

app.post('/proxy/psa/tickets', async (req, res) => {
  const inc = req.body;               // RocketCyber incident object
  const ticket = {
    summary:    inc.title,
    initialDescription: inc.description,
    company:   { id: mapToCompanyId(inc.accountId) },
    board:     { name: 'Security' },
    status:    { name: inc.status === 'open' ? 'New' : 'Closed' },
    externalXRef: `RC-${inc.id}`
  };
  const r = await fetch('https://api-na.myconnectwise.net/v4_6_release/apis/3.0/service/tickets', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Basic ${CW_AUTH_TOKEN}`,
      'clientId': CW_CLIENT_ID
    },
    body: JSON.stringify(ticket)
  });
  res.json(await r.json());
});

Demo Mode

How demo data is structured, how to identify it, how to switch to live

When the proxy is unavailable or returns a non-200 response, the console falls back to demo data automatically. The demo data is embedded in the script block as DEMO_ACCOUNTS, DEMO_AGENTS, DEMO_APPS, DEMO_INCIDENTS, and DEMO_EVENTS. All field names in the demo objects match the real API schema exactly — the structures are identical, only the values are synthetic.

Demo Data Characteristics

FAQ & Troubleshooting

Common issues and how to resolve them