Settings

Settings holds the gateway's own configuration; changing it requires the administrator role. Saved values are written to the gateway's state volume and apply immediately, without a restart. Values set here take precedence over the matching settings in .env, which only seed the first start; see the Configuration reference. The tabs at the top also lead to Users, AI settings and License.

Connect the QRadar Console

On a fresh install with no Console configured, the page shows the Connect to your QRadar card. When the token expires or changes, update it in the same place.

Prerequisites

• Administrator role.
• An authorized-service SEC token; see QRadar token permissions.

Steps

1. Under QRadar Console connection, enter the Console URL, such as https://qradar.corp.local, without a path.
2. Enter the SEC token. If a token is already saved, leave it empty to keep it.
3. (Optional) Enter the REST API version. Empty means 20.0.
4. (Optional) If the Console has a trusted certificate, turn on Verify the server certificate. For a private CA, enter the path inside the container under CA certificate path, usually /certs/qradar-ca.pem; setting it turns verification on.
5. Select Test connection.
6. When the test passes, select Save and apply.

The test shows the Console version and whether each of four API families (Ariel, Offenses, rules, log sources) is reachable. If one is not, the page names the APIs the token cannot reach, and the matching pages stay empty. You cannot save until the test passes.

Changing the Console URL or token does not reset the offense sync cursor.

Set the data scope and masking

Steps

1. Under Data access, enter the Log source whitelist: comma-separated log-source names or ids, * allowed, such as WinCollect @ *,PaloAlto-*,63. Empty means every log source the token can see.
2. Select the Field masking mode.
3. Select Save and apply.

How the whitelist is enforced is described in QRadar token permissions. All three masking modes are available in every edition:

Configure audit and forwarding

Steps

1. Under Audit and forwarding, turn on Enable auditing.
2. (Optional) Change Audit retention (days); the default is 180.
3. (Optional) Enter a syslog address (RFC 5424) and a webhook address (POSTs JSON). Leave saved values empty to keep them.
4. Select Save and apply.

Once enabled, sign-ins, queries, model calls, offense write-backs, settings changes and other events are written to copilot.db and shown in the Audit log. Forwarding to syslog and webhook is an Enterprise feature, and syslog can point at QRadar itself. Webhook targets are limited by RST_AUDIT_WEBHOOK_ALLOWLIST, and TLS verification applies to the webhook only.

Update the version

Version and updates shows the Current version. The gateway checks GitHub Releases for new versions once a day, in every edition, so the host must be able to reach GitHub. When a new version appears, select Download and stage. Operations then installs it on the host; see Upgrade, rollback and backup.