Settings
Admin configuration: QRadar Console connection, log-source whitelist, masking mode, audit and forwarding, online update. Changes apply at once.
An admin page. Changes are written to the gateway's state volume and survive restarts; the same-named variables in .env are only initial values, and the UI wins once it has been used.
QRadar connection
| Field | Meaning |
|---|---|
| Console URL | https://qradar.corp.local, no path |
| SEC token | An authorized-service token from Admin → Authorized Services; blank keeps the current value. Its security profile decides which log sources and offenses the gateway sees, see Token permissions |
| REST API version | Blank means 20.0 (QRadar 7.5); 16.0 for 7.4 |
| Verify server certificate | Consoles are usually self-signed, so off by default; turn on for a trusted certificate, or give a CA path below (inside the container, usually /certs/qradar-ca.pem; setting it turns verification on) |
"Test connection" must pass before saving. The test reports the Console version and whether each of the Ariel / Offenses / rules / log-source families answers; the one that does not is what the token's role lacks.
On a fresh install without QRadar configured, this block sits as a setup card in front of every page. An expired token brings you back here too.
Data scope and masking
Log-source whitelist: comma-separated names or ids, * allowed, e.g. WinCollect @ *,PaloAlto-*,63. The model only sees whitelisted sources in its catalogue, and the gateway checks every AQL against it before the Ariel search: a reference outside the whitelist is refused, and a statement naming no source gets LOGSOURCENAME(logsourceid) IN (...) appended. Blank = everything the token can see.
Field masking: what happens to data before it reaches the model. All three modes in every edition:
| Mode | Behaviour | For |
|---|---|---|
| cloud | IPs, accounts, hostnames replaced with placeholders (10.30.x.x); hashes and IOCs kept | Model in a public cloud |
| private | Only secrets and credentials removed | Model in your own data centre |
| airgapped | Nothing leaves the network; for local models | Air-gapped sites |
RST_MASKING_MODE can pin it. A mode the licence does not allow is reported as such.
Audit and forwarding
With audit on, every login, query, model call, offense write-back and settings change is recorded in the audit table of copilot.db (what the Audit log page reads) and can be forwarded to syslog (RFC 5424; QRadar itself is a valid target) and a webhook (POST JSON). Webhook targets are limited by RST_AUDIT_WEBHOOK_ALLOWLIST. Retention defaults to 180 days with automatic pruning.
Version and updates
After one heartbeat on an online licence, the gateway learns from the licence server whether a newer version exists. "Download and stage" verifies the signature and stores the image under ./release/staging; installation is done by ops on the host with ./deploy/rst-update.sh (health-gated, automatic rollback), see Upgrade and backup.
Saving
"Save and apply" takes effect at once, no restart. Changing the Console URL or token keeps the offense-sync cursors; to re-read history, use the sync settings on Offenses.
Platform health
QRadar deployment checks: Console connection and version, managed hosts, EPS licence usage, log-source status, ingest freshness, offense backlog, auto-discovered log sources, each with a verdict; the paid AI reading ties the failing ones together and says what to fix first.
Users and roles
Three roles: administrators change configuration, analysts investigate, read-only only looks. Create, disable, reset passwords, delete; role changes apply at once. Needs the separate user table (Postgres).