> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/pam/get-started/console-tour.md). # A tour of the console How the console is divided into areas, how to switch between them and between organizations, and which screen holds each kind of object. The console is one web application divided into **areas**, selected from the bar at the top. Each area serves a different job — consuming access, administering the environment, auditing it — and which areas you see depends on your role, not on a preference. Almost every screen is a list of one of the objects described in [Core concepts](/pam/get-started/core-concepts.md). Once you know which area an object lives in, the interface stops needing a tour. ## The areas | Area | Who works here | What it holds | | --------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | **Cockpit** | Everyone who consumes access | The assets you are authorized to reach, the sessions you open, your requests, your files, your own vault | | **Sysadmin** | Administrators | Assets, platforms, accounts, authorizations, users, connectivity — everything that defines the environment | | **Audit** | Auditors and administrators | Sessions and their recordings, commands, logins, password changes, operations, reports | | **System settings** | Administrators | Instance-wide configuration: authentication providers, security, notifications, storage, retention, components, licensing | | **Personal settings** | Everyone | Your own profile, password, MFA, SSH key, API access key, connection tokens, and web-terminal preferences | The three built-in organization roles line up with the first three areas: an *Org User* works in Cockpit, an *Org Admin* in Sysadmin, an *Org Auditor* in Audit. Custom roles mix them per module — see [Roles and permissions](/pam/administration/identities/roles.md). {% hint style="info" %} An area you cannot see is a role question, not a bug. If a menu entry is missing, check the permissions on your role before looking anywhere else. {% endhint %} ## Switching organization The same top bar carries the **organization selector**. Each organization is an isolated tenant: its own users, assets, accounts, authorizations, tags and audit records, with nothing shared between them. This matters more than it looks. An asset you created is only visible in the organization you were in when you created it, and an auditor sees only their own organization's sessions. When something you registered "has disappeared", check the selector first. ## Sysadmin, group by group | Group | Screens | What you do there | | --------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | — | **Dashboard** | Sessions today, sessions online, user and device counts, trend charts, device distribution by type, and rankings of most active users and devices over today, 7 days or 30 days | | **Environment** | **Discover**, **Assets**, **Platforms** | Register the devices to protect, scan networks and clouds for new ones, and manage the platform each asset belongs to | | **Gateway** | **Proxy**, **Brokers**, **Connectors** | The network paths: zones and their jump machines, the reverse-access broker, and the agents on machines that publish themselves | | **Accounts** | **Accounts**, **Templates**, **Automations** | The credentials the solution manages, the reusable definitions behind them, and the scheduled work — rotation, collection, provisioning, vault backup | | **Policies** | **Authorization**, **Just in time**, **User login**, **Command inspection**, **Asset login**, **Connect method**, **UEBA** | Who may reach what, how, when, with which commands allowed, and what happens when behaviour looks anomalous | | **Users** | **Users**, **Groups**, **Profiles** | The people who log in, the groups authorizations are written against, and the roles that decide what they may do in the console | | **Others** | **Tags** | Labels used to filter asset lists and scope reports | {% hint style="warning" %} **Nothing under Environment grants access.** Registering an asset and its account makes them manageable, not reachable. Access exists only where an [authorization](/pam/administration/access/authorizations.md) says so. {% endhint %} ## Audit, group by group | Group | Screens | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | — | **Dashboard**, and **UEBA** for the behaviour baseline, risk scores and anomalies | | **Sessions** | **Online** for live monitoring and termination, **Recordings**, **Keylogger** for the commands typed, **Transfers** for files moved, **Requests** for access requests | | **Console** | **Login log**, **Session records**, **Online users**, **Password changes** | | **Log audit** | **Action log** — creation, modification and deletion of objects | | **Operation audit** | **Job list** and **Executions** — the automations and each of their runs | | **Reports** | **Builder** and **Scheduled** | **Session records** is the screen most investigations start from: every session that has been opened, with its user, asset, account, protocol, start and end times, duration, and the button that plays the recording back. See [Audit trail](/pam/administration/audit/audit-trail.md) for what each record answers. ## Cockpit, group by group | Group | Screens | | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | — | **Dashboard**, **Access** — the assets you may reach — and **Vault**, your own credentials for external sites and applications | | **JIT** | **My requests** and **To approve** | | **Files** | **File transfer** and **File explorer**, for moving and browsing files on remote devices | | **Automations** | **Commands** for ad-hoc execution across several assets, **Job list** for scheduled work replacing cron and Windows Scheduler, **Templates**, **Executions**, and **Tools** for quick ping, telnet, tcpdump and traceroute checks | **Access** is the screen a regular user lives in. Each entry shows the device name, its address, the platform, the connectivity status, and the account to use; the tree on the right filters by folder and by **Favorites**. Opening a session from here offers the methods your policies allow: | Method | What it is | Protocols | | ----------------- | ----------------------------- | --------------------------------------------------------- | | **Web CLI** | Terminal in the browser | SSH, Telnet | | **Web GUI** | Remote desktop in the browser | RDP, VNC | | **Native client** | Your own local client | SSH, RDP | | **DB client** | Database access | MySQL, PostgreSQL, Oracle and the other supported engines | See [Connection methods](/pam/administration/sessions/connection-methods.md) for how the available methods are restricted. ## Where each object lives | Object | Where | | ------------------------------------------------ | ----------------------------------------------------------- | | Asset | **Environment › Assets** | | Platform | **Environment › Platforms** | | Network and cloud scan | **Environment › Discover** | | Account | **Accounts › Accounts** | | Account template | **Accounts › Templates** | | Rotation, collection, provisioning, vault backup | **Accounts › Automations** | | Authorization | **Policies › Authorization** | | Command filter | **Policies › Command inspection** | | Login restriction | **Policies › User login** | | Proxy zone and its gateways | **Gateway › Proxy** | | Broker and its remote gateways | **Gateway › Brokers** | | User, group, role | **Users › Users**, **Users › Groups**, **Users › Profiles** | | Tag | **Others › Tags** | | Live session | **Audit › Sessions › Online** | | Finished session and its recording | **Audit › Console › Session records** | | Commands typed in a session | **Audit › Sessions › Keylogger** | | Report | **Audit › Reports** | | Retention windows | **System settings › Retention** | | Authentication providers | **System settings › Authentication** | | Component health | **System settings › Components** | ## Common errors | Symptom | Cause | Fix | | --------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------------------------------- | | An area or menu entry is missing | Your role does not grant that module | Check the role's permissions — see [Roles](/pam/administration/identities/roles.md) | | An asset you registered is not in the list | You are in a different organization now | Switch back with the organization selector in the top bar | | An auditor sees no sessions | Sessions belong to another organization | Audit visibility is scoped per organization | | The user has assets in Cockpit but no connection method appears | A connect method rule denies every method for them | Review **Policies › Connect method** | | A session has a record but no replay | Recording was disabled, or retention has passed | See [Session recordings](/pam/administration/audit/recordings.md) | ## Related pages * [Core concepts](/pam/get-started/core-concepts.md) — what each object in these lists is * [Roles and permissions](/pam/administration/identities/roles.md) — what decides which areas you see * [Onboard your first managed asset](/pam/get-started/first-managed-asset.md) — these screens used in order * [Audit trail](/pam/administration/audit/audit-trail.md) — the Audit area in detail