A tour of the UI
The two navigation groups, accounts and roles, the Ctrl+K command palette, and the quota bar while unactivated.
Login
https://<hostname>/v2/. The first account is the admin set by deploy.sh; there is no self-registration, people are added on the Users page.
Pages
The sidebar has two groups. Security posture, Settings and Platform health each carry in-page tabs holding the other seven pages.
| Group | Page | What |
|---|---|---|
| Security operations | Security posture | Offense totals, high-severity count, log-source anomalies, platform issues; tabs for Offenses and Reports |
| Ask AI | One question over events / flows, follow-up turns | |
| Investigations | Archive of investigations, triage runs and result readings | |
| Triage | Cluster, score and rank a batch of offenses (paid) | |
| Rule copilot | Rule Wizard designs from one sentence (paid) | |
| Administration | Platform health | QRadar deployment checks + AI reading (reading is paid); tabs for Audit log and Outbound channels |
| Settings | QRadar connection, log-source whitelist, masking, offense sync, online update; tabs for Users, AI settings, License |
Command palette
Ctrl+K (⌘K on macOS) or the search box top-left: type a page name to jump, or browse recent query history.
Accounts and roles
The avatar top-right: current account and role, profile, preferences (language, light / dark theme), sign out. Language and theme are saved with the account and follow it across browsers.
| Role | Can |
|---|---|
| Admin | Change configuration, manage accounts, activate licences |
| Analyst | Query, investigate, triage, act on offenses (including notes / close / assign written back to QRadar); cannot change gateway configuration |
| Viewer | Query and read; changes nothing, including offenses |
Quota while unactivated
Without an activated licence the free capabilities keep working under a daily LLM-call quota (200 by default, RST_TRIAL_DAILY_LIMIT). The bottom of the sidebar shows what is left today and when it resets. Activation removes the limit.
Two global notices
- "Not connected to QRadar yet": no Console URL and token configured. Set them in Settings and test; until then queries, offenses and analysis have no data source. An expired token shows the same notice.
- "Not synced": history / preferences / saved queries are only in this browser for now; they sync once the gateway is back.
Upgrade, rollback and backup
Three ways to upgrade (re-run deploy.sh in place, online update, manual tag switch), health-gated rollback, the three things to back up and a restore drill. QRadar's own data is not the gateway's to back up.
Ask AI
One question over events or flows. The gateway writes AQL, checks it is read-only, preflights it and runs an Ariel search; the result is a flat table, and the AQL is always there to inspect, edit or open in the Console.