Settings
Administrator configuration: the Elasticsearch connection, index whitelist, field-masking mode, audit and forwarding, online update. Changes apply immediately.
Administrator page. Changes are written to the gateway's state volume and survive restarts; the same-named variables in .env are initial values only, and once changed in the UI the UI wins.
Elasticsearch connection
| Field | Notes |
|---|---|
| Cluster URL | https://es.corp.local:9200; several nodes comma-separated |
| Username / password | Leave empty when the cluster has no security; an empty password keeps the stored one |
| Verify server certificate | Off for self-signed certs, or give a CA path below (in-container path, usually /certs/ca.pem; setting it turns verification on) |
"Test connection" must pass before saving. If it passes but says "this account cannot list indices", grant monitor and read on the target indices, or the query page stays empty.
On a fresh install without ES this block appears as a setup card in front of every page.
Data access and masking
Index whitelist: comma-separated patterns the gateway may query, e.g. logs-*,filebeat-*. Smart query, investigations and the field dictionary stay inside it; a model trying to query outside is refused (visible in an investigation's retrieval trace). Do not leave it empty.
Field-masking mode: treatment of data before it reaches the model. All three modes are in every edition:
| Mode | Behaviour | For |
|---|---|---|
| cloud | IPs, accounts, hostnames replaced with placeholders (10.30.x.x); hashes and IOCs kept | Model in a public cloud |
| private | Only secrets and credentials removed | Model in the own data centre |
| airgapped | Nothing leaves the network; for local models | Air-gapped sites |
RST_MASKING_MODE pins it from the environment.
Audit and forwarding
With audit on, every login, query, model call and settings change is written to .rst_copilot_audit in ES (what the Audit page reads) and can be forwarded to syslog (RFC 5424) and a webhook (POST JSON). Webhook targets are restricted by RST_AUDIT_WEBHOOK_ALLOWLIST.
The audit index grows forever; when you turn audit on, also set RST_ILM_BOOTSTRAP=1 and RST_AUDIT_RETENTION_DAYS.
Version and update
After an online licence's first heartbeat the gateway learns about new versions from the licence server. "Download and stage" verifies the signature and stores the image under ./release/staging; installing is done on the host by operations with ./deploy/rst-update.sh (health-gated, automatic rollback), see Upgrade and backup.
Saving
"Save and apply" takes effect immediately, no gateway restart.
Platform health
A check-up of the Elastic cluster: cluster state, shards, disk, ILM, time baseline, permissions, with a verdict per item; the paid "AI read" ties failing items together and says what to fix first.
Users and roles
Three roles: administrators change configuration, analysts investigate, read-only only looks. Create, disable, reset passwords, delete; role changes apply at once. Needs the separate user table (Postgres).