Prismatic Hawkeye Web

Overview

Prismatic Hawkeye Web provides the LiveView-based dashboard for the HAWKEYE visitor intelligence system. It renders real-time visitor analytics, behavioral pattern visualizations, threat indicator alerts, and entity intelligence gathered from web traffic analysis -- all delivered through server-rendered HTML with WebSocket-driven live updates that require zero client-side JavaScript frameworks.

The dashboard transforms raw visitor data from Prismatic Hawkeye into actionable intelligence views. Operators can drill down from aggregate traffic patterns to individual visitor sessions, examining technology fingerprints, geographic origins, and behavioral classifications. The threat view surfaces bot activity, credential stuffing attempts, and reconnaissance patterns in real time, enabling immediate response to active threats.

Built entirely with TailwindCSS and Flowbite components, the interface follows the platform's design standards for consistency across all dashboard applications. Every component leverages Phoenix LiveView's efficient DOM diffing to minimize bandwidth usage while maintaining sub-second update latency. The architecture ensures that no sensitive visitor intelligence data is exposed in client-side JavaScript state -- the server computes HTML diffs and pushes only changed bytes over the WebSocket connection, maintaining both performance and security.

Architecture

Prismatic Hawkeye (Backend)
        | PubSub Events
Hawkeye Web LiveView Processes
        | WebSocket Push
Browser Dashboard (Server-Rendered HTML)
        |
TailwindCSS + Flowbite Components

Each connected dashboard session runs as an independent LiveView process supervised under OTP. The PubSub system broadcasts visitor events to all connected sessions, ensuring every operator sees identical real-time data without polling overhead.

The LiveView architecture provides several advantages for an intelligence dashboard. Server-side rendering means that no visitor data needs to be serialized to JSON and sent to a client-side framework -- the server computes the HTML diff and pushes only the changed bytes over the WebSocket connection. This reduces both bandwidth consumption and the risk of sensitive intelligence data being exposed in client-side JavaScript state.

Key Modules

Key Features

Real-Time Dashboard

• Live visitor count with geographic distribution maps updated in real time
• Behavioral pattern visualization with clustering overlays showing visitor segments
• Threat indicator alerts with severity-based color coding and escalation actions
• Technology stack fingerprinting display (OS, browser, libraries, frameworks)

Dashboard Mount and Event Handling

The main dashboard subscribes to multiple PubSub channels on mount, receiving real-time updates for visitor events, threat alerts, and analytics changes:

defmodule PrismaticHawkeyeWeb.DashboardLive do
  use PrismaticHawkeyeWeb, :live_view

  @impl true
  def mount(_params, _session, socket) do
    if connected?(socket) do
      PrismaticHawkeye.subscribe(:visitor_events)
      PrismaticHawkeye.subscribe(:threat_alerts)
      PrismaticHawkeye.subscribe(:analytics_updates)
    end

    {:ok, assign(socket,
      visitors: load_recent_visitors(),
      threats: load_active_threats(),
      stats: load_dashboard_stats(),
      visitor_count: PrismaticHawkeye.active_visitor_count()
    )}
  end

  @impl true
  def handle_info({:visitor_event, event}, socket) do
    visitors = update_visitor_list(socket.assigns.visitors, event)
    stats = recalculate_stats(visitors)
    count = socket.assigns.visitor_count + visitor_count_delta(event)
    {:noreply, assign(socket, visitors: visitors, stats: stats, visitor_count: count)}
  end
end

Analytics Views

• Visitor segmentation by behavior patterns and risk profile with drill-down capability
• Geographic heatmap of access origins with drill-down by region and country
• Temporal access pattern analysis with hourly and daily aggregations for trend identification
• Bot vs. human traffic classification with confidence scores and evidence links

Intelligence Reports

• Entity-specific intelligence summaries with threat timeline and behavioral history
• Automated threat briefings generated from detection rules with severity prioritization
• Periodic analytics reports with configurable delivery schedules and distribution lists
• Custom dashboard configurations saved per operator for personalized intelligence views

Threat Detection Views

The threat detection views provide real-time visibility into malicious activity patterns. Each threat indicator is displayed with its classification, confidence level, source evidence, and recommended response action.

# LiveView component for threat indicator display
defmodule PrismaticHawkeyeWeb.Components.ThreatIndicator do
  use Phoenix.Component

  attr :threat, :map, required: true
  attr :class, :string, default: ""

  def threat_card(assigns) do
    ~H"""
    <div class={"rounded-lg border p-4 #{severity_class(@threat.severity)} #{@class}"}>
      <div class="flex items-center justify-between">
        <span class="font-semibold"><%= @threat.type %></span>
        <span class="text-sm"><%= @threat.confidence %>% confidence</span>
      </div>
      <p class="mt-2 text-sm text-gray-400"><%= @threat.description %></p>
    </div>
    """
  end
end

Visitor Session Detail

The visitor detail view provides comprehensive session reconstruction, showing every page visited, interaction timing, and behavioral signals that contributed to classification decisions:

Routes

Usage

The web interface is served via Phoenix LiveView with real-time WebSocket updates. Access is controlled through the platform's authentication and RBAC system.

# LiveView mount with real-time subscription
def mount(_params, session, socket) do
  if connected?(socket) do
    PrismaticHawkeye.subscribe(:visitor_events)
    PrismaticHawkeye.subscribe(:threat_alerts)
  end

  {:ok, assign(socket, visitors: [], threats: [], stats: load_stats())}
end

# Handle incoming visitor events via PubSub
def handle_info({:visitor_event, event}, socket) do
  visitors = update_visitor_list(socket.assigns.visitors, event)
  stats = recalculate_stats(visitors)
  {:noreply, assign(socket, visitors: visitors, stats: stats)}
end

# Handle threat alerts with severity-based routing
def handle_info({:threat_alert, alert}, socket) do
  threats = [alert | socket.assigns.threats] |> Enum.take(100)
  {:noreply, assign(socket, threats: threats)}
end

NABLA Compliance

Testing

LiveView tests verify component rendering, PubSub event handling, and WebSocket state management. Route tests verify authentication and RBAC enforcement on all dashboard paths. Component tests verify correct rendering of threat indicators, visitor cards, and analytics charts with known data fixtures.

Integration tests exercise the full pipeline from backend event emission through PubSub delivery to LiveView DOM updates. Performance tests verify that dashboard mount time stays under 150ms and event processing under 50ms as required by the platform's page load performance standard.

Integration Points

Performance

Telemetry events: [:prismatic, :hawkeye_web, :page_load], [:prismatic, :hawkeye_web, :event_processed], [:prismatic, :hawkeye_web, :threat_displayed].

Related Resources

• Prismatic Perimeter Web -- Sibling dashboard for EASM, sharing design patterns
• Prismatic Telemetry -- Metrics collection powering dashboard performance monitoring
• Elixir Architect -- Ensures LiveView processes follow OTP supervision patterns
• Alert Management Specialist -- Configures threat indicator alerting and notification delivery
• API Design Specialist Agent -- Reviews PubSub event interface between backend and dashboard
• Real-Time Monitoring -- Powers live visitor analytics with sub-second update latency
• Telemetry Integration -- Tracks dashboard performance metrics
• Quality Gates -- Validates LiveView component rendering and design consistency

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator