Observability Hub

4Context

4 panes of context.

Four layers of real-time telemetry in one unified interface: infrastructure, services, security, and AI agents. It continuously polls all registered cluster nodes and streams live telemetry without touching public networks.

4CONTEXTReal-time · 4 layers
Infrastructure
CPU12%
RAM34%
NET 2.1 Gbps
Services
API Gateway OK
lvls Vault OK
LLM Router OK
CI/CD OK
Security
IDS Events0 events
WazuhOK
Open Alerts0
AI Agents
Active4
Idle3
Tasks Today12
Unified Telemetry

Four Panes of Context

Eliminating fragmented monitoring stacks. 4Context correlates hardware load with agent tasks, service daemons, and security triggers under a single synchronized timeline.

PANE 01Hardware Telemetry

Host Infrastructure

Real-time CPU cores, RAM allocation, NVMe disk I/O, and Tailscale network throughput across every host machine.

CPU usage per core
RAM saturation & swap
Disk write velocity
Network I/O rate
PANE 02Process Health

Core Services

Continuous health monitoring for all Cluster1 daemons: Clutch, PRISM, lvls, and Rime agent runtimes.

Daemon uptime & PID
Thread health checks
Memory consumption
Crash recovery state
PANE 03Wazuh & OSSEC

Security Telemetry

Intrusion detection event stream, rogue port scan flags, file integrity changes, and failed authentication attempts.

Wazuh rule alerts
IDS/IPS trigger stream
Integrity check logs
Threat severity flags
PANE 04Fleet Task Stream

AI Agent Activity

Live per-agent task tracking, token consumption velocity, inter-agent delegation steps, and completion stages.

12-agent live status
Token burn velocity
Active step tracking
Delegation tree log
Architecture & Engine

30-Second Polling & In-Memory Redis Bus

Lightweight background daemon collectors poll every registered node on a deterministic 30-second cadence. Data is committed to an in-memory Redis ring buffer, eliminating persistent database strain while feeding sub-millisecond WebSocket live streams.

Telemetry Lifecycle
Node Agent Probes (CPU / RAM / Socket / Task Events)
  │  every 30 seconds via secure loopback
  ▼
4Context Ingest Collector
  ├── Commits raw snapshot to in-memory Redis Ring Buffer (zero disk bottleneck)
  ├── Runs rule evaluator against Wazuh alert signatures
  └── Broadcasts JSON diff over secure WebSocket to Operator Dashboard
30s
Polling Cadence
< 1ms
WebSocket Latency
100%
In-Memory Redis
0
Public Ingress Ports
Intrusion Defense

Wazuh IDS/IPS Threat Neutralization

4Context embeds real-time Wazuh and OSSEC intrusion detection engines. Every agent process execution, system call, and socket open is verified against active security rules.

Process Verification

Flags unauthorized sub-process spawning or unexpected shell invocations by autonomous agents before actions reach execution.

Network Anomaly Triggers

Detects non-Tailscale egress attempts, unauthorized IP port scanning, and suspicious DNS lookup attempts instantly.

Automated Containment

Critical severity alerts trigger automatic agent freeze and socket termination, isolating anomalies without crashing the cluster.

Interactive Command

Operator Control Dispatch

4Context is not merely a passive dashboard. It provides authenticated operator control to take immediate operational actions across all nodes.

Agent Fleet Pause / ResumeEmergency Interlock

Instantly halt all running agent execution steps across nodes during anomaly investigation.

Authority Level: OPERATOR
Redis Cache InvalidationCache Control

Purge cached state snapshots and force instantaneous synchronous cluster re-polling.

Authority Level: SYSTEM
Service Daemon RestartZero-Downtime

Gracefully cycle specific Cluster1 daemons with zero host downtime or session loss.

Authority Level: MAINTENANCE
Lockdown QuarantineNetwork Isolation

Isolate a specific compromised node from the Tailscale mesh while maintaining internal evidence logs.

Authority Level: CRITICAL
Deployment & Security ArchitectureLoopback & Tailscale CGNAT Only
Bearer Token Auth
All API endpoints and WebSocket channels require cryptographic token auth.
Zero Public DNS
Zero public internet routing. Accessible only via authenticated Tailscale nodes.
Automatic Crash Recovery
Managed by background process supervisor with automatic restart on reboot.
Zero External Telemetry
Logs and metrics remain strictly within your perimeter. No third-party SaaS egress.

Explore the full platform

Five integrated components. One unified system.