Users and roles
Three roles: administrators change configuration, analysts investigate, read-only only looks. Create, disable, reset passwords, delete; role changes apply at once. Needs the separate user table (Postgres).
Prerequisite: the user table
A single-account deployment (only RST_ADMIN_USERNAME / RST_ADMIN_PASSWORD_HASH in .env) cannot add people; the page says so. For multiple accounts:
deploy.shstarts a Postgres container (userdb) and setsRST_USER_DB_URLby default;- for manual installs give the gateway
RST_USER_DB_URL=postgresql://user:pass@host:5432/rst_usersand restart.
The table lives in the userdb_data volume; back it up. Losing it leaves only the first administrator.
With an IdP use SSO instead; accounts then come from the IdP and this page is not used.
Three roles
| Role | Can |
|---|---|
| Administrator | Change settings, manage accounts, activate the licence, configure AI, see all audit events |
| Analyst | Query, investigate, triage, change alert dispositions, upload runbooks, import the ledger; cannot change gateway configuration |
| Read-only | Query, search, read explanations and reports; changes nothing, including alert dispositions |
Read-only accounts still see every page; write buttons are disabled with a reason. Role changes take effect immediately, no re-login.
New user
Username, initial password (8+ characters), role. No email is sent; hand over the initial password and have it changed on the Account page.
Disable / reset password / delete
- Disable: kicks every session of that account immediately; the account stays and can be re-enabled.
- Reset password: also kicks every session; the person signs in with the new password.
- Delete: irreversible. Personal preferences and saved queries go with it; their saved triage runs and uploaded runbooks are team-shared and stay.
The account marked "current session" cannot delete itself.
Settings
Administrator configuration: the Elasticsearch connection, index whitelist, field-masking mode, audit and forwarding, online update. Changes apply immediately.
AI models
Which LLMs, in what failover order, how much reasoning; the knowledge-base embedding model; provider health and 24-hour call volume.