WP Activity Log writes every audited event to wp_wsal_occurrences with related metadata in wp_wsal_metadata. Each row carries an alert_id, a created_on timestamp, a user_id, a site_id, an event severity, and the human-readable alert message rendered from the metadata. The default WP Activity Log dashboard renders these rows as a paginated table, which is fine for periodic browsing and falls short when a security lead needs to know which events are still under investigation today.

SleekView Kanban reads the same wp_wsal_occurrences rows the WP Activity Log dashboard queries. Pick a derived wsal_state field that buckets events by severity, the alert_id grouping, the user role responsible for the action, and a review workflow tag and every entry becomes a card grouped under Unreviewed, Investigating, Acknowledged, or Resolved. Card fronts can show the alert message, the username, the severity, the source IP from the metadata, and the timestamp so a security lead can prioritize work from a single board.

Dragging a card between columns writes a review workflow tag into the WP Activity Log metadata. A move from Investigating to Resolved flips a custom workflow tag and timestamps the action. WP Activity Log's own external destinations (Mirror to Slack, email, SIEM forwarding) continue to run for new events as they arrive, so a manual move on the board never silences a fresh alert that lands in the same minute as a triage action.

WP Activity Log captures everything, which is exactly what makes the default dashboard hard to use. The sortable table is great when an auditor knows what they are looking for and almost useless when a security lead is trying to coordinate a team across a week of events. Most teams end up exporting a CSV, dropping it into a spreadsheet, and tagging events by hand.

The spreadsheet drifts within days. New events keep landing in WP Activity Log without a workflow tag, the spreadsheet records resolutions that nobody copies back, and by the end of the month the two views disagree on what is still open. A kanban view that reads and writes the same WSAL metadata as the dashboard keeps the security team and the source of truth aligned.

Unreviewed events surface immediately. Investigating cards stay visible across shifts. Resolved events carry a documented decision and a named analyst, all without leaving WordPress.