An incident-style error collector that groups repeated failures by message, tracks occurrence counts, and surfaces critical/high severity errors before they become client-facing outages.
The Problem
Security automation tools fail silently more often than anyone admits. A SOAR playbook throws an unhandled exception at 3 AM. A compliance evidence collector hits a malformed API response and stops mid-run. A client-facing dashboard breaks on a null value nobody tested for.
Most teams find out from a support ticket, not from the system itself. By the time a client reports the bug, the same error has already happened 300 times and the audit trail is whatever scattered console logs are left in a server that already restarted.
For platforms that handle security operations, an unmonitored error in the automation layer is itself a risk: a missed alert, a skipped compliance check, a silent gap in coverage.
The Solution
A lightweight error tracker treating every failure as an incident, not a log line. Errors are ingested via a single POST endpoint, automatically grouped by message so repeated failures collapse into one trackable record, and triaged through a status workflow (New, Investigating, Resolved, Ignored) instead of disappearing into a log stream.
Key Features:
- Single POST endpoint accepts message, stack trace, URL, browser, severity, and timestamp
- Automatic grouping by error message with running occurrence count and first/last seen timestamps
- Four-stage triage workflow: New, Investigating, Resolved, Ignored
- Severity classification: Critical, High, Medium, Low, Info, with visual highlighting on the table
- Trend sparklines on stat cards showing 7-day movement for total, new, critical, and resolved counts
- Errors by Severity and Errors by Status donut charts for instant triage prioritization
- Full detail panel per error: stack trace, user agent, browser/OS, occurrence count, and notes field
- Filter and search by severity, status, time range, and free-text message search
Use Cases
MDR / SOC-as-a-Service platforms: Track failures in your own alert enrichment and triage pipeline. An unhandled error in the triage automation is an undetected gap in client coverage. Surface it before a client does.
GRC compliance tools: Evidence collection scripts that silently fail mean missing compliance documentation. Group errors by message so a single API change that breaks ten client integrations shows up as one high-occurrence incident, not ten separate mysteries.
MSSP operators: Multi-tenant automation surfaces different failure modes per client environment. Severity-based triage means a critical failure affecting billing or alert delivery gets attention before a cosmetic dashboard glitch.
Offensive Security / Pentest platforms: Report generation and scan orchestration tools fail on edge-case target environments. Stack trace capture with URL and browser context speeds up reproduction without re-running engagements.
Impact
- Repeated failures collapse into one incident instead of flooding logs with duplicate noise
- Critical and High severity errors are visually impossible to miss on the dashboard
- Mean time to detection drops from "client reported it" to "dashboard flagged it"
- Full stack trace and environment context eliminates back-and-forth reproduction requests
Built by Kunsh Tanwar | ETXcyberops | [email protected]
