---
title: "Web console tutorial"
description: "Step-by-step tutorial for the Calico Cloud web console interface, walking the left navbar from dashboards to policy, observability, threat defense, and image scanning."
product: "Calico Cloud"
version: "v23.0.1"
section: "Tutorials"
canonical_url: "https://docs.tigera.io/calico-cloud/tutorials/calico-cloud-features/tour"
---

# Web console tutorial

## What you will learn

- Web console features and controls
- How to gain visibility into clusters

Let's go through each item in the web console left navbar from top to bottom. You can follow along using any cluster.

## Dashboards

> From the left navbar, click Dashboards.

Dashboards help you see and understand the activity in your cluster. Each dashboard is made up of categorized graphs, charts, and diagrams that visually represent the data in your logs.

![dashboards](https://docs.tigera.io/assets/images/dashboards-1379b9f25f778cc843aad5e4d93b6e2d.png)

- The **Cluster Health** dashboard provides a birds-eye view of cluster activity.

- The **Traffic Volume** dashboard provides a high-level view of traffic in your cluster.

- The **DNS Logs** dashboard summarizes DNS data and logs into metrics, providing high-level information on the types of DNS lookups made, responses, and overall DNS performance.

- The **Flow Logs** dashboard gives you an overview of how packets are being sent and received by all the pods in your cluster.

- The **HTTP Traffic** dashboard provides application performance metrics for in-scope Kubernetes services.

- The **Network Performance** dashboard provides TCP metrics to help you identify bottlenecks, packet loss, and performance issues.

## Service Graph

> From the left navbar, select **Service Graph**, **Default**

Service Graph provides a point-to-point, topographical representation of network traffic within your cluster. It is the primary tool for visibility and troubleshooting.

![service-graph](https://docs.tigera.io/assets/images/service-graph-c9f93fd4af2aca81b0f206bc33b52df1.png)

**Namespaces**

Namespaces are the default view in Service Graph.

When you expand the top right panel `<<`, you see a detailed view of the service-to-service communications for the namespace.

![service-graph-namespace](https://docs.tigera.io/assets/images/service-graph-namespace-84290605685f69e4cbf9978f9c139c79.png)

**Nodes and edges**

Lines going to/from nodes are called edges. When you click on a node or edge, the right panel shows details, and the associated flow logs are automatically filtered in the bottom panel.

![edges](https://docs.tigera.io/assets/images/edges-09ed813a34ae40daaeb95a45eaca32f1.png)

**Layers**

Layers allow you to create meaningful groupings of resources so you can easily hide and show them on the graph. For example, you can group resources for different platform infrastructure types in your cluster like networking, storage, and logging.

> Click the panel on the left (`>>`) by the Namespaces breadcrumb, and then expand the Tigera components layer.

![service-graph-layers](https://docs.tigera.io/assets/images/service-graph-layers-a00a600903ced24c407d6759bb3fd4a5.png)

The **Tigera components** layer contains namespaces for Calico Cloud networking components, and a view of interest to Dev/Ops.

> Click the vertical ellipses and select, **Hide layer**. Notice that only the business application namespaces remain visible in the graph.

> To make this layer less visible, select **Restore layer**and click **De-emphasize layer**.

**Logs, alerts, and capture jobs**

The panel at the bottom below the graph provides tools for troubleshooting connectivity and performance issues. **Logs** (Flows, DNS, and HTTP) are the foundation of security and observability in Calico Cloud. When you select a node or edge in the graph, logs are filtered for the node or service. For example, here is a flow log with details including how the policies were processed in tiers.

![service-graph-flows](https://docs.tigera.io/assets/images/service-graph-flows-c6dc0245f9ec1c658e22ef37b4fc3a11.png)

**Alerts**

For convenience, the Alerts tab duplicates the alerts you have enabled in the **Alerts tab** in the left navbar. By default, alerts are not enabled.

**Capture jobs**

Service Graph integrates a packet feature for capturing traffic for a specific namespace, service, replica set, daemonset, statefulset, or pod. You can then download capture files to your favorite visualization tool like Wireshark.

> Right-click on any endpoint to start or schedule a capture.

![packet-capture-service](https://docs.tigera.io/assets/images/packet-capture-service-63418f90801d2a2a907bcea44ea486ae.png)

**Flow Visualizations**

> From the left navbar, select **Service Graph**, **Flow Visualizations**.

Flow Visualizer (also called, "FlowViz") is a Calico Cloud tool for drilling down into network traffic within the cluster to troubleshoot issues. The most common use of Flow Visualizer is to drill down and pinpoint which policies are allowing and denying traffic between services.

![flow-viz](https://docs.tigera.io/assets/images/flow-viz-27724211909480cfff53f8f24bfb5b3e.png)

## Policies

> From the left navbar, click **Policies**.

Network policy is the primary tool for securing a Kubernetes network. Policy is used to restrict network traffic (egress and ingress) in your cluster so only the traffic that you want to flow is allowed. Calico Cloud supports these policies:

- Calico Cloud network policy
- Calico Cloud global network policy
- Kubernetes policy

Calico Cloud uses **tiers** (also called, hierarchical tiers) to provide guardrails for managing network policy across teams. Policy tiers allow users with more authority (for example, Dev/ops user) to enforce network policies that take precedence over teams (for example, service owners and developers).

**Policies Board** is the default view for managing tiered policies.

![policy-board](https://docs.tigera.io/assets/images/policy-export-4ad7d802ef2607aa0c8c94c4ebf2b65b.png)

Users typically use a mix of Policy Board and YAML files. Note that you can export one or all policies in a tier to YAML.

The **Policy Board filter** lets you filter by name, namespace, policy types and label selectors.

![policy-filters](https://docs.tigera.io/assets/images/policy-search-49291425438596bf9f9ab8f48f2d2869.png)

The following features provide more security and guardrails for teams.

**Recommended a policy**

> In Policies Board, click **Recommend a policy**.

One of the first things you'll want to do after installation is to secure unprotected pods/workloads with network policy. (For example, Kubernetes pods allow traffic from any source by default.) The Recommend a policy feature generates policies that protect specific endpoints in the cluster. Users with minimal experience with network policy can easily get started.

![recommend-policy](https://docs.tigera.io/assets/images/recommend-policy-61392143274f8323a197cc58822d1515.png)

**Policy stage**

When you create a policy, it is a best practice to stage it to evaluate the effects before enforcing it. After you verify that a staged network policy is allowing traffic as expected, you can enforce it.

![stage-policy](https://docs.tigera.io/assets/images/stage-policy-c28c75e6d7b7383f4c97521d25b39ea2.png)

**Preview**

When you edit a policy, you can select **Preview** to see how changes may affect existing traffic.

![policy-preview](https://docs.tigera.io/assets/images/policy-preview-b2efca933be175d85ece43ac331086e2.png)

## Endpoints

> From the left navbar, click **Endpoints**.

**Endpoint Details**

This page is a list of all pods in the cluster (also known as workload endpoints).

![endpoints](https://docs.tigera.io/assets/images/endpoint-c61da8f69c506b8d3f1ea9e07ae3a86a.png)

**Node List**

This page lists all nodes associated with your cluster.

![node-list](https://docs.tigera.io/assets/images/node-list-36469f7b1d899eab62352f6b9e535142.png)

## Network Sets

Network sets and global network sets are Calico Cloud resources for defining IP subnetworks/CIDRs, which can be matched by standard label selectors in policy (Kubernetes or Calico Cloud). They are a powerful feature for use/reuse and scaling policy.

A simple use case is to limit traffic to/from external networks. For example, you can create a global network set with "deny-list CIDR ranges 192.0.2.55/32 and 203.0.113.0/24", and then reference the network set in a global network policy. This also allows you to see this traffic in Service Graph.

![networksets](https://docs.tigera.io/assets/images/networksets-2d9a5b9fc54f066e0d56759466069563.png)

## Managed clusters

> From the left navbar, click **Managed clusters**.

This page is where you switch views between clusters in the web console. When you connect to a different cluster, the entire Manager view changes to reflect the selected cluster.

![managed-clusters](https://docs.tigera.io/assets/images/managed-clusters-6de294f55b709c8f94c39c821beea02a.png)

## Compliance Reports

> From the left navbar, click **Compliance**.

Compliance tools that rely on periodic snapshots, do not provide accurate assessments of Kubernetes workloads against your compliance standards. Calico Cloud compliance dashboard and reports provide a complete inventory of regulated workloads, along with evidence of enforcement of network controls for these workloads. Additionally, audit reports are available to see changes to any network security controls.

**Compliance reports** are based on archived flow logs and audit logs for all Calico Cloud resources, and audit logs for Kubernetes resources in the Kubernetes API server.

![cis-benchmark](https://docs.tigera.io/assets/images/cis-benchmark-758732e64f5f030d9be6614ded180d7b.png)

Using the filter, you can select report types.

![compliance-filter](https://docs.tigera.io/assets/images/compliance-filter-5c608aa64ba8279c89e6aec62662c310.png)

## Activity

> From the left navbar, select **Activity**, **Timeline**.

**Timeline**

What changed, who did it, and when? This information is critical for security. Native Kubernetes doesn’t provide an easy way to capture audit logs for pods, namespaces, service accounts, network policies, and endpoints. The Calico Cloud timeline provides audit logs for all changes to network policy and other resources associated with your Calico Cloud deployment.

![timeline](https://docs.tigera.io/assets/images/timeline-edf282abcdc13cdb589632bcc6524495.png)

> From the left navbar, selection **Activity**, **Alerts**.

**Alerts**

How do you know if you have an infected workload? A possible threat? Calico Cloud detects and alerts on unexpected network behavior that may indicate a security breach. You can create alerts for:

- Known attacks and exploits (for example, exploits found at Shopify, Tesla, Atlassian)
- DOS attempts
- Attempted connections to botnets and command and control servers

![alerts](https://docs.tigera.io/assets/images/alerts-eb83344c5ce74227aab9893340fae546.png)

## Logs

Calico Cloud includes a fully-integrated deployment of Elastic to collect flow log data that drives key features like the Flow Visualizer, metrics in the Dashboard and Policy Board, policy automation, and testing features and security.

> From the left navbar, click **Logs**.

## Threat feeds

You can add threat intelligence feeds to Calico Cloud to trace network flows of suspicious IP addresses and domains. Then, you can use network policy to block pods from contacting IPs or domains.

Now that you understand the basics, we recommend the following:

- [Service Graph tutorial](https://docs.tigera.io/calico-cloud/tutorials/calico-cloud-features/service-graph.md)
- [Understanding policy tiers](https://docs.tigera.io/calico-cloud/network-policy/policy-tiers/tiered-policy.md)
- [Understanding network sets](https://docs.tigera.io/calico-cloud/tutorials/calico-cloud-features/networksets.md)