Installation
Configuration reference
Every setting in .env: required, login and accounts, QRadar connection and AQL budgets, model and reasoning, offense sync, scheduled reports, platform-check thresholds, audit and retention. Values changed in the UI win.
Everything lives in .env in the install directory and is read when docker compose starts. After editing .env, run docker compose -f docker-compose.prod.yml up -d to recreate the gateway container.
Whatever can be changed on Settings and AI settings (QRadar connection, log-source whitelist, masking, audit forwarding, offense sync, providers) is stored on the gateway's state volume and takes precedence over .env. For those keys .env is only the seed for the first start.
Required
| Variable | Meaning |
|---|---|
QRADAR_URL | Your QRadar Console, https://qradar.corp.local, no path |
QRADAR_SEC_TOKEN | Authorized-service SEC token; rights in QRadar token permissions |
LLM_API_KEY / LLM_BASE_URL / LLM_MODEL | The first LLM provider |
CADDY_SITE_ADDRESS | Hostname analysts use; several separated by spaces |
RST_GATEWAY_SHARED_SECRET | Shared secret between Caddy and the gateway, generated by deploy.sh |
RST_ADMIN_TOKEN | Ops API token (X-RST-Admin-Token header), generated |
RST_ADMIN_PASSWORD_HASH | First admin's password hash, generated. Unset, the gateway refuses every non-local login |
GATEWAY_IMAGE_TAG | Image tag in use; written by deploy.sh, changed by rst-update.sh on upgrade |
Login and accounts
| Variable | Default | Meaning |
|---|---|---|
RST_ADMIN_USERNAME | admin | First admin's username |
RST_SESSION_TTL_HOURS | 12 | Login session lifetime |
RST_USER_DB_URL | set by compose | Postgres for multi-user accounts; empty = single account |
RST_USER_DB_PASSWORD | generated | Password of the bundled userdb container |
RST_ALLOW_DEFAULT_PASSWORD | empty | 1 allows the factory password from the LAN (isolated trials only) |
RST_CORS_ORIGINS | empty | Cross-origin sources; the gateway serves the front-end itself, so normally unneeded |
QRadar connection and AQL
| Variable | Default | Meaning |
|---|---|---|
QRADAR_API_VERSION | 20.0 | The Version: request header. 20.0 for 7.5; 16.0 for 7.4 |
RST_QRADAR_VERIFY_CERTS | false | Verify the Console certificate. Consoles are usually self-signed, so off by default; true for a trusted certificate |
RST_QRADAR_CA_CERT | empty | Private CA path inside the container, e.g. /certs/qradar-ca.pem; put the file in ./certs/. Setting it turns verification on |
RST_AQL_TIMEOUT_SECONDS | 120 | Budget per AQL: the search is cancelled after polling this long and qradar_timeout is returned |
RST_AQL_MAX_ROWS | 1000 | Hard row cap; a generated AQL without LIMIT, or with a larger one, is clamped to this |
RST_AQL_DEFAULT_WINDOW_MINUTES | 60 | Window added when the question names no time |
RST_LOG_SOURCE_WHITELIST | empty | Strongly recommended: comma-separated log-source names or ids, * allowed, e.g. WinCollect @ *,PaloAlto-*,63. Limits the catalogue the model sees; every Ariel search is checked against it, and a statement that names no source gets LOGSOURCENAME(logsourceid) IN (...) appended |
RST_LOG_SOURCE_CACHE_S | 300 | Log-source catalogue cache |
RST_ARIEL_SCHEMA_CACHE_S | 900 | Ariel column-definition cache |
RST_CONVERSATION_TTL_DAYS | 7 | Idle lifetime of a multi-turn conversation |
RST_DSL_CACHE_TTL_S | 300 | Cache of NL→AQL results for identical questions; 0 = off |
Model and reasoning
| Variable | Default | Meaning |
|---|---|---|
LLM_TIMEOUT_S | 180 | Per-call model timeout; raise if investigation / triage / rule drafting time out |
LLM_REASONING | auto | Reasoning effort for this provider: auto / off / low / high, see AI settings |
RST_NL2AQL_REASONING | low | Effort for the NL→AQL step in Ask AI: none / low / high / native |
RST_LLM_FIRST_TOKEN_TIMEOUT_S | 45 | Hard cap on time to first token when generating a query; 0 = none |
RST_AGENTIC_INVESTIGATE | 1 | Offense investigation gathers evidence itself through the aql_search tool; models without function calling fall back to a single pass |
RST_AGENTIC_DEADLINE_S | 180 | Total budget of one investigation in seconds; 0 = none |
RST_TRIAGE_LLM_CHUNK / RST_TRIAGE_LLM_CONCURRENCY | 4 / 3 | Clusters per model call and concurrency in batch triage |
RST_MASKING_MODE | from licence | Force the masking mode cloud / private / airgapped |
RST_TIMEZONE | UTC | Timezone the model uses for "today / yesterday" |
RST_TRIAL_DAILY_LIMIT | 200 | Daily LLM calls while unactivated |
RST_RATELIMIT_GENERATE / _EXECUTE | 30 / 30 | Per-IP per-minute limits; raise for a large team behind one egress IP |
Offense sync
| Variable | Default | Meaning |
|---|---|---|
RST_OFFENSE_INGEST_ENABLED | 1 | Poll /api/siem/offenses once QRadar is configured; 0 = off, the Offenses page only syncs by hand |
RST_OFFENSE_INGEST_INTERVAL_SECONDS | 30 | Poll interval |
RST_OFFENSE_INGEST_LOOKBACK | 7d | How far the first sync looks back (6h / 30d). Offenses live for days; too short misses the open backlog |
RST_OFFENSE_MIN_MAGNITUDE | 0 | Offenses below this magnitude (0–10) are neither stored nor pushed |
RST_OFFENSE_INGEST_CONCURRENCY | 4 | Summary concurrency (one model call per offense) |
RST_ALERT_SUMMARY | 1 | 0 = store without an AI summary |
RST_ALERT_SUMMARY_MIN_SEVERITY | info | Summaries only above this level |
Each tick reads at most 10 pages × 100 rows; the rest follows on the next tick. offense_ingest_page_cap_reached in the gateway log means the backlog is bigger than one tick and is expected.
Scheduled reports
| Variable | Default | Meaning |
|---|---|---|
RST_REPORT_SCHEDULE | empty | daily,weekly,monthly; empty = none |
RST_REPORT_TZ | follows RST_TIMEZONE | Timezone of the period boundaries |
RST_REPORT_WEBHOOK_URL / _HEADERS | empty | Every report is POSTed here |
RST_REPORT_PERSIST | 1 | Archive in copilot.db |
RST_REPORT_CHECK_INTERVAL_SECONDS | 1800 | Scheduler check interval |
RST_REPORT_CATCHUP_MAX | 7 | Periods to catch up after downtime |
RST_REPORT_TRIAGE | 0 | 1 appends an automatic triage to each report (one model call; paid engine) |
Platform-check thresholds
| Variable | Default | Meaning |
|---|---|---|
RST_PLATFORM_EPS_WARN_PCT / _FAIL_PCT | 85 / 100 | EPS usage as a percentage of the licence |
RST_PLATFORM_STALE_WARN_H / _FAIL_H | 6 / 24 | Hours without events before a log source counts as stale |
RST_PLATFORM_OFFENSE_WARN / _FAIL | 200 / 800 | OPEN offense backlog |
Audit and retention
| Variable | Default | Meaning |
|---|---|---|
RST_AUDIT_ENABLED | true | Write audit events to the audit table in copilot.db |
RST_AUDIT_RETENTION_DAYS | 180 | Audit retention |
RST_AUDIT_SYSLOG_URL | empty | Forward audit to syslog, udp:// / tcp:// / tls://host:port; QRadar itself is a valid target |
RST_AUDIT_WEBHOOK_URL / _HEADERS | empty | Forward audit to a webhook |
RST_AUDIT_WEBHOOK_ALLOWLIST | empty | Allowed webhook hosts; empty = only loopback / link-local refused |
RST_ANALYSIS_TTL_DAYS | 30 | Retention of investigation records |
RST_METRICS_TOKEN | empty | /metrics scrape token |
Resources
| Variable | Default | Meaning |
|---|---|---|
RST_GATEWAY_CPUS / RST_GATEWAY_MEM | 2 / 2g | Gateway container caps |
RST_STATE_DB | /app/state/copilot.db | SQLite state file (inside the container) |
SSO variables are in Enterprise SSO.
Installing from the archive
What is in the delivery archive, what each step of deploy.sh does, how to answer each prompt, how to install by hand, and the post-install checklist.
QRadar token permissions
Give the gateway a dedicated authorized service: the security profile decides which log sources and offenses it sees, the user role decides which endpoints it may call. With the permission behind each endpoint and how to verify.