Settings

Shown across the dashboard and on exported reports.

Colleagues with an email address on this domain can request access without you issuing them a code. They still land in the approval queue — nothing here verifies that someone owns the address they typed, so a domain match is a hint, never a key. Leave blank to require an invite for everyone.

Confidence a non-benign prediction must reach before it counts as a detection. Lower catches more and cries wolf more.

Automatically mark flows above τ as mitigated, without an operator pressing anything.

How far back to look when deciding a source keeps coming back. Three auto-throttles inside this window flags it as a repeat offender on the alerts page.

Detections below this level are still recorded and still appear in the flow table and incident list — they just don't raise a desktop notification. Severity is derived from the class and confidence of the detection, so a low-confidence port scan ranks below a high-rate flood.

Stored and validated, but nothing is posted to it yet. Outbound delivery is deliberately unimplemented: fetching a user-supplied URL from the server needs SSRF protection first, or a webhook pointing at 169.254.169.254 would turn this box into a way to read the host's cloud credentials. Use browser notifications below until it lands.

Browser notifications for high-confidence detections.

A collector agent runs on a machine you are monitoring and posts flows to /api/ingest. It authenticates with one of these keys instead of an account, so it never holds a person's password and can be revoked on its own.

How often to poll when the live WebSocket is unavailable.

Higher values keep more history on screen and use more memory.

Leave blank when the backend serves this dashboard, which is the default. Set it only if you host the UI separately.

Calls /api/health and reports exactly what comes back.