Press ? on any page for the shortcuts that apply there.
Everywhere
| Keys | Action |
|---|---|
| Ctrl K or ⌘ K | Universal search. |
| / | Focus the page's search. |
| [ | Collapse or expand the sidebar. |
| Shift D | Switch between light and dark theme. |
| ? | Show the shortcuts sheet. |
Go to
Press g, then:
| Key | Page |
|---|---|
| o | Overview |
| b | Dashboards |
| a | Alerts |
| l | Logs |
| h | Hosts |
| d | Detections |
| c | Cases |
| r | Response |
| p | Playbooks |
| t | Tickets |
| n | Notifications |
| s | Settings |
Alerts queue
| Keys | Action |
|---|---|
| j / k | Next / previous row. |
| o or Enter | Preview the row. Double-click opens the full page. |
| Space | Select the row. |
| n / p | Next / previous page. |
| f / F | Filter on the focused row's host, or exclude it. |
| r | Refresh. |
| s | Show or hide the graphs. |
| t | Switch between timeline and breakdown. |
| b / v | Fields sidebar / filters panel. |
In the alert preview: j / k move between alerts, o opens the full alert, t edits tags and x or Esc closes it.
Logs page
| Keys | Action |
|---|---|
| Ctrl F | Find in results without re-running the query. |
| j / k | Next / previous row. |
| o or Enter | Open the document. |
| x or Esc | Close it. |
| f / F | Filter on the focused row's host, or exclude it. |
| t | Cycle the time range. |
| b / v | Fields sidebar / filters panel. |
| ; | Field shorthand in the query, for example ;ppe for process.parent.executable. |
Response
On the fleet list, j / k move, Enter opens a host, n / p page, c shows connected hosts only and r refreshes.
On a host, 1 to the last number switch tabs, , / . move between them, h switches host, i opens the isolation dialog, t runs quick triage and Esc returns to the fleet.