What a sysadmin actually does every week in monsys.ai

SELECT a.hostname, l.event_type,
       l.event_data->>'reason' AS reason,
       u.email AS actor, l.created_at
  FROM audit_log l
  LEFT JOIN agents a ON a.id = l.agent_id
  LEFT JOIN users  u ON u.id = l.user_id
 WHERE l.tenant_id = $1::UUID
   AND l.created_at >= NOW() - INTERVAL '72 hours'
 ORDER BY l.created_at DESC;

curl -X POST https://app.monsys.ai/api/v1/kernel-updates/batches \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-TOTP-Code: 123456" \
  -d '{
    "title":           "USN-2026-1234 — kernel 6.8.0-49.49",
    "target_kernel":   "6.8.0-49.49",
    "package_manager": "apt",
    "reboot_strategy": "auto-at-window",
    "selector_kind":   "tag",
    "selector_value":  {"tag":"production"}
  }'

SELECT title, COUNT(*),
       MIN(created_at), MAX(created_at)
  FROM alerts
 WHERE tenant_id = $1::UUID
   AND created_at >= NOW() - INTERVAL '24 hours'
 GROUP BY title
 ORDER BY 2 DESC LIMIT 10;

# Identity surface — search across systems
curl 'https://app.monsys.ai/api/v1/identity/persons?email=alice@acme.com' \
  -H "Authorization: Bearer $TOKEN"

# Bulk revoke via a playbook EAT (TOTP required)
curl -X POST https://app.monsys.ai/api/v1/agents/<id>/emergency \
  -H "X-TOTP-Code: 123456" \
  -d '{"actions":[{"kind":"run_playbook","id":"revoke-user"}]}'

SELECT a.hostname, b.tool, b.destination,
       b.last_successful_run,
       NOW() - b.last_successful_run AS age,
       b.last_failure_message
  FROM backup_configs b
  JOIN agents a ON a.id = b.agent_id
 WHERE b.tenant_id = $1::UUID
   AND 'production-db' = ANY(a.tags)
 ORDER BY b.last_successful_run NULLS FIRST;