Activity, requests and insights

Overview

The console’s Overview is the first page after sign-in: a setup checklist for admins until every step is done, the last 7 days against the 7 before (viewers, requests, sign-ins), previews Closing soon with Extend, recent activity, agents, and your plan’s usage.

Each figure with a list behind it is a link, and the list adds up to the same number:

Tile	Opens
Open previews	Previews, with scheduled previews included when there are any
Active viewers · 7 d	The request log, Viewer requests, 7 days
Sign-ins · 7 d	The request log, Sign-ins, 7 days
Refused · 7 d	The request log, Refused, 7 days

“7 days” is today so far and the 6 whole days (UTC) before it, as on Insights and the request log. Everyone sees figures for the previews they can see.

Request log

Request log in the sidebar, for every member. It lists every request Houseguest™ answered for the previews you can see, newest first: time, preview, method, hostname and path, the decision, and the viewer when known.

Tabs: All, Viewer requests, Sign-ins, Refused and Monitors, each with its count.
Range: today, 7 days (the default), 30 days or 90 days.
Preview: one preview, or all you can see.
Clear filters returns to the defaults. 50 rows a page, with Newer and Older.
Export downloads what the filters select as CSV (up to 10,000 rows).

The filters live in the address, so a filtered view can be bookmarked or shared with a teammate who can see the same previews.

Refused here counts requests turned away before or during sign-in: no session, after the end, a suspended workspace, an address not on the list, and wrong codes. A preview’s own Refused tab is narrower: it leaves the sign-in steps under its Sign-in tab and adds requests made before a scheduled preview starts. The two numbers can differ for the same preview.

Activity log

Activity log in the sidebar (needs View activity log; Owner, Admin and Auditor have it).

It merges two sources:

Console changes: every change made in the console (previews, viewers, agents, domains, members, roles, settings), sign-ins to the console, refused attempts, and agents connecting and disconnecting.
Viewer sign-in steps: codes accepted, invites used, wrong codes, not-on-list attempts, sign-outs and command-line sign-ins, on previews you can see.

Filter by search (person, subject, hostname, action, preview), date range (today, 7, 30 or 90 days, all, or custom dates), person, action, preview and outcome, and by kind: All, Console, Viewers or Access changes (roles, members, groups, share groups, invites, revokes and list changes). A row opens the event’s details. Export downloads what the filters select as CSV (up to 10,000 rows).

Viewer rows carry no IP address: the request log keeps none.

Streaming to a SIEM

Settings › Security › Audit streaming (SIEM) sends new activity and refused viewer requests to your own collector every 30 seconds, as JSON lines or in Splunk HEC format, with a bearer token. It needs Change security settings and Export activity log.

The endpoint must be https:// on a public address. Redirects are not followed.
Turning it on starts from now: history is not sent. Send test event checks the connection.
If delivery fails, Houseguest retries with growing gaps (up to an hour) and shows the last error. Nothing is skipped.
The token is never shown again after you save it.

Insights

Insights in the sidebar (needs View insights; every built-in role has it except Billing). Insights covers only the previews View insights reaches: a Member sees their own previews, someone granted it on a share group or one preview sees those, and Owners, Admins and Auditors see the whole workspace. When it covers part of the workspace, the page says how many previews it covers, the filters list only those previews and share groups, and the terminal-shares card shows only shares on them (and the person’s own). For the last 7, 14, 30 or 90 days, for everything it covers, one preview or one share group:

viewer requests, unique viewers, sign-ins, the median time from being invited to first use, and the share of refused requests;
requests and sign-ins per day, top previews, refusal reasons;
a weekday by hour heat map (UTC);
viewers’ countries and devices (browser family and system, and desktop, mobile or tablet);
usage against your workspace’s limits (only for people who can see every preview);
Terminal shares: how long each person’s shares from their computer ran.

Export CSV downloads one row per day, over the same previews (needs Export insights).

Countries come from the viewer’s network address, which is looked up and not stored. Devices come from the browser’s user agent, reduced to a family such as Chrome · macOS; the header itself is not stored.

Uptime checkers

A monitor that requests a preview every few minutes to check it answers would otherwise fill the Refused count. Houseguest recognises these uptime checkers by their user agent: Uptime Kuma, UptimeRobot, Pingdom, StatusCake, Better Stack (Better Uptime), Datadog Synthetics, Site24x7, Checkly, Google Cloud uptime checks and Amazon Route 53 health checks.

They get the same answer as anyone else, and the same rate limits and blocks.
The Overview, Insights, the activity log, the preview page’s counts and the Request log leave them out, including the request log’s All and its exports.
The Request log lists them under Monitors, and so does a preview’s Requests tab.
SIEM streaming still sends their refused requests.

A checker that sends a browser’s user agent is counted like a browser. Requests recorded before this was added stay counted.

Notifications

The bell in the console shows previews closing within 24 hours, offline agents, members invited and domains verified in the last 48 hours, and email use near the daily limit.