UI overview
The three navigation groups, accounts and roles, and the command palette.
The gateway UI is at https://<hostname>/v2/. The first account is the admin set by deploy.sh. There is no self-registration; an administrator adds accounts on the Users page.
Pages
The left navigation has three groups. Security posture, Settings, and Platform health carry in-page tabs that hold seven more pages.
| Group | Page | Purpose |
|---|---|---|
| Operations | Security posture | Alert count, critical and high count, baseline drift, platform issues. Tabs: Alerts, Reports |
| Ask AI | Plain-language log queries with follow-up questions | |
| Investigations | Archive of alert investigations, triage runs, and result readouts | |
| Triage | Cluster, score, and rank a batch of alerts (paid) | |
| Detection rules | Generate a Kibana detection rule from plain language (paid) | |
| Reference | Field dictionary | Fields in an index, with sample values |
| Runbooks | SOP knowledge base cited by the AI | |
| Asset inventory | Business asset and owner behind a host, account, or IP | |
| Baseline checks | CIS and MLPS 2.0 verdicts over osquery results | |
| Admin | Platform health | Elastic cluster check-up with an AI reading (paid). Tabs: Audit log, Outbound channels |
| Settings | Elasticsearch connection, index whitelist, masking, online update. Tabs: Users, AI settings, License |
Command palette
Press Ctrl+K (Cmd+K on macOS) or select the search box in the top left. Type a page name to jump to it. Recent queries are listed too.
Account and roles
The account menu in the top right holds Profile and Preferences. Preferences cover language, theme, and the Default index for queries. They are stored with the account, so they follow you to any browser.
| Role | Permissions |
|---|---|
| Administrator | Change configuration, manage accounts, activate the license |
| Analyst | Query, investigate, triage, and set alert dispositions. Cannot change gateway configuration |
| Read-only | Query, search, and read explanations. Cannot change anything |
Global banners
| Banner | Cause | Action |
|---|---|---|
| "Not connected to Elasticsearch yet." | The gateway has no Elasticsearch address, so queries, alerts, and analysis have no data source | Enter the cluster URL in Settings and test the connection |
| Not synced | History, preferences, saved queries, or triage state are held only in this browser | None. They sync when the gateway is reachable again |
Upgrade, rollback and backup
Upgrade the gateway with a delivery archive, online update or a manual image switch, roll back, and back up and restore the four data sets.
Ask AI
Query logs and alerts in Elasticsearch in plain language. The gateway translates each question into read-only DSL and dry-runs it before execution.