WP Cerber Security keeps a rich schema by WordPress standards: wp_cerber_log stores the activity log with event codes and the user, IP, and details, wp_cerber_acl holds black and white list rules, wp_cerber_traffic records HTTP requests when traffic inspection is on, and wp_cerber_lab_ip caches IP intelligence. The plugin's screens cover the basics, but each table is presented in its own list with a fixed shortlist of filters.

SleekView reads each table as a first-class grid. Activity, ACL, and traffic each get their own view, with joins on IP available so an ACL rule shows alongside the recent activity from that IP and the cached IP intelligence. Saved views capture the filter and column set, so failed-login triage, traffic spikes, or ACL audits each reopen in one click.

Inline writes route through Cerber's own functions where supported (for example to add an entry to wp_cerber_acl) and fall back to direct table writes with conflict detection where they do not. The activity log itself remains read-only by design; annotations live in a separate store so Cerber's audit chain stays untouched.

WP Cerber is one of the few WordPress security plugins that keeps a full activity log in its own tables rather than offloading to a cloud service. That choice is a gift to operations teams because every event, every ACL change, and every traffic record is queryable on the same database the rest of the site runs on. The cost is that the plugin's default screens cannot do justice to that data: they list rows, paginate, and apply a fixed shortlist of filters, when what triage actually needs is a flexible grid where every column is filterable and every IP joins to its intelligence label.

Treating wp_cerber_log, wp_cerber_acl, and wp_cerber_traffic as joined sources turns the data from a feed into a working investigation surface. Saved views let the next on-call admin reopen the same triage with one click rather than rebuilding it. ACL writes stay inline so the action happens where the question was asked.

The activity log itself remains read-only so the audit chain holds. Cerber records the trail; a real grid turns the trail into a tool.