Configuration reference
Settings in .env in the installation directory: required values, sign-in and accounts, QRadar connection and AQL, model and reasoning, output language, offense sync, scheduled reports, platform check-up thresholds, audit and retention, resources.
Configuration lives in .env in the installation directory. After a change, run docker compose -f docker-compose.prod.yml up -d; the change applies once the gateway container is recreated. Settings not listed here can stay at their defaults. .env.example in the archive describes every setting.
Values you can change in Settings and AI settings (QRadar connection, log-source whitelist, masking mode, audit, offense sync, providers) are stored on the gateway's state volume and take precedence over .env. In .env they only seed the first start.
Starting with 1.0.2, every setting in .env is passed to the gateway container. In 1.0.1 and earlier, a standard install passes only the settings listed in docker-compose.prod.yml, so settings marked "1.0.2 or later" on this page have no effect when written to .env.
Required
| Setting | Description |
|---|---|
QRADAR_URL | QRadar Console URL, such as https://qradar.corp.local, without a path |
QRADAR_SEC_TOKEN | Authorized-service SEC token. See QRadar token permissions |
LLM_API_KEY, LLM_MODEL | API key and model name of the first LLM provider |
CADDY_SITE_ADDRESS | Hostname analysts use |
RST_GATEWAY_SHARED_SECRET | Shared secret between Caddy and the gateway, generated by deploy.sh |
RST_ADMIN_TOKEN | Operations API token, sent in the X-RST-Admin-Token header, generated by deploy.sh |
RST_USER_DB_PASSWORD | Password of the PostgreSQL account database, generated by deploy.sh |
GATEWAY_IMAGE_TAG | Gateway image version to run, written by deploy.sh and rst-update.sh |
Sign-in and accounts
| Setting | Default | Description |
|---|---|---|
RST_ADMIN_USERNAME | admin | Account name of the first administrator |
RST_ADMIN_PASSWORD_HASH | Empty | Password hash of the first administrator, with every $ written as $$. When empty, the factory password works only from the gateway host itself |
RST_SESSION_TTL_HOURS | 12 | Sign-in session lifetime in hours |
RST_USER_DB_URL | Written by deploy.sh | Account database connection string. When empty, there is a single admin account and users cannot be added |
RST_ALLOW_DEFAULT_PASSWORD | Empty | 1 allows sign-in with the factory password over the network. For isolated test environments only |
QRadar connection and AQL
| Setting | Default | Description |
|---|---|---|
QRADAR_API_VERSION | 20.0 | REST API version. Use 20.0 for 7.5 and later |
RST_QRADAR_VERIFY_CERTS | false | Verify the Console certificate |
RST_QRADAR_CA_CERT | Empty | Path of a private CA inside the container, such as /certs/qradar-ca.pem; put the file in ./certs/ in the installation directory. Setting it turns verification on |
RST_AQL_TIMEOUT_SECONDS | 120 | Time budget for one Ariel search. On timeout the search is cancelled and qradar_timeout is returned |
RST_AQL_MAX_ROWS | 1000 | Row cap. A missing or larger LIMIT in the AQL is set to this value |
RST_AQL_DEFAULT_WINDOW_MINUTES | 60 | Time window in minutes when the question names no time |
RST_LOG_SOURCE_WHITELIST | Empty | Log-source whitelist: comma-separated log-source names or ids, * allowed, such as WinCollect @ *,PaloAlto-*,63. See QRadar token permissions |
RST_LOG_SOURCE_CACHE_S | 300 | Log-source catalog cache in seconds. 1.0.2 or later |
RST_ARIEL_SCHEMA_CACHE_S | 900 | Ariel field definition cache in seconds. 1.0.2 or later |
RST_DSL_CACHE_TTL_S | 600 | Cache in seconds for AQL generated from an identical question; 0 turns it off |
RST_CONVERSATION_TTL_DAYS | 7 | Days without activity before a thread expires |
Model and reasoning
| Setting | Default | Description |
|---|---|---|
LLM_BASE_URL | https://ark.cn-beijing.volces.com/api/v3 | Endpoint of the first provider |
LLM_TIMEOUT_S | 180 | Timeout for one model call, in seconds |
RST_LLM_THINKING_TIMEOUT_S | 600 | Timeout for high-reasoning calls (the end of an investigation); the larger of this and LLM_TIMEOUT_S applies. 1.0.2 or later |
LLM_REASONING | auto | Reasoning effort of the first provider: auto, off, low, high |
RST_NL2AQL_REASONING | low | Reasoning effort for the AQL-generation step of Ask AI: none, low, high, native. 1.0.2 or later |
RST_LLM_FIRST_TOKEN_TIMEOUT_S | 45 | Maximum wait for the model's first token while generating a query, in seconds; 0 for no limit |
RST_AGENTIC_INVESTIGATE | 1 | Offense investigation runs AQL over several rounds chosen by the model. 0 runs a single-step investigation. Models without function calling fall back to single-step automatically. 1.0.2 or later |
RST_AGENTIC_MAX_STEPS | 8 | Maximum search rounds in an investigation, 1 to 20. 1.0.2 or later |
RST_AGENTIC_DEADLINE_S | 180 | Total time budget for one investigation, in seconds; 0 for no limit. 1.0.2 or later |
RST_TRIAGE_LLM_CHUNK, RST_TRIAGE_LLM_CONCURRENCY | 4, 3 | Clusters per model call and concurrent calls in batch triage. 1.0.2 or later |
RST_MASKING_MODE | cloud | Masking mode: cloud, private, airgapped |
RST_TIMEZONE | UTC; deploy.sh writes +08:00 | Site timezone, as +08:00 or Asia/Shanghai. It sets what "today" means to the model and where report periods begin |
RST_OUTPUT_LANG | zh | Output language of background work with no user behind it (offense summaries, scheduled reports, notifications): zh or en. Output an analyst triggers follows that analyst's interface language. 1.0.2 or later |
RST_RATELIMIT_GENERATE, RST_RATELIMIT_EXECUTE | 30, 30 | Query generations and executions per IP per minute. Raise them when many analysts share one egress IP |
Offense sync
| Setting | Default | Description |
|---|---|---|
RST_OFFENSE_INGEST_ENABLED | 1 | Sync offenses from QRadar on a schedule. 0 turns it off, and the Offenses page syncs only on demand |
RST_OFFENSE_INGEST_INTERVAL_SECONDS | 30 | Sync interval in seconds |
RST_OFFENSE_INGEST_LOOKBACK | 7d | How far back the first sync looks, in s, m, h, d or w, such as 6h or 30d |
RST_OFFENSE_MIN_MAGNITUDE | 0 | Offenses below this magnitude (0 to 10) are neither stored nor pushed |
RST_OFFENSE_INGEST_CONCURRENCY | 4 | Concurrent AI summaries; each offense takes one model call |
RST_ALERT_SUMMARY | 1 | 0 stores offenses without an AI summary. 1.0.2 or later |
RST_ALERT_SUMMARY_MIN_SEVERITY | info | Summarize only offenses at or above this severity. 1.0.2 or later |
Each sync cycle fetches at most 10 pages. When the backlog is larger, the gateway log shows offense_ingest_page_cap_reached and the rest is fetched in the next cycle.
Scheduled reports
| Setting | Default | Description |
|---|---|---|
RST_REPORT_SCHEDULE | Empty | Comma-separated combination of daily, weekly and monthly. Empty means no scheduled reports |
RST_REPORT_TZ | Same as RST_TIMEZONE | Timezone of report period boundaries |
RST_REPORT_WEBHOOK_URL, RST_REPORT_WEBHOOK_HEADERS | Empty | Each report is POSTed to this URL |
RST_REPORT_PERSIST | 1 | Archive reports in copilot.db |
RST_REPORT_CHECK_INTERVAL_SECONDS | 1800 | Scheduler check interval in seconds |
RST_REPORT_CATCHUP_MAX | 7 | Maximum missed periods generated after downtime; 0 for none |
RST_REPORT_TRIAGE | 0 | 1 appends an automatic triage section to each report. It takes one model call and needs a paid license. 1.0.2 or later |
Platform check-up thresholds
These settings take effect starting with 1.0.2.
| Setting | Default | Description |
|---|---|---|
RST_PLATFORM_EPS_WARN_PCT, RST_PLATFORM_EPS_FAIL_PCT | 85, 100 | EPS usage as a percentage of the licensed rate |
RST_PLATFORM_STALE_WARN_H, RST_PLATFORM_STALE_FAIL_H | 6, 24 | Hours without events before a log source counts as stale |
RST_PLATFORM_OFFENSE_WARN, RST_PLATFORM_OFFENSE_FAIL | 200, 800 | Backlog of OPEN offenses |
RST_PLATFORM_OFFENSE_OLD_DAYS | 7 | Days an offense can stay open before it counts as old |
Audit and retention
| Setting | Default | Description |
|---|---|---|
RST_AUDIT_ENABLED | true | Write the audit trail to copilot.db |
RST_AUDIT_RETENTION_DAYS | 180 | Audit retention in days |
RST_AUDIT_SYSLOG_URL | Empty | Forward audit to syslog as udp://, tcp:// or tls://host:port; it can point at QRadar itself. Enterprise. 1.0.2 or later |
RST_AUDIT_WEBHOOK_URL, RST_AUDIT_WEBHOOK_HEADERS | Empty | Forward audit to a webhook. Enterprise. 1.0.2 or later |
RST_AUDIT_WEBHOOK_ALLOWLIST | Empty | Allowed webhook hosts. When empty, only loopback and link-local addresses are refused |
RST_ANALYSIS_TTL_DAYS | 30 | Investigation record retention in days. 1.0.2 or later |
RST_METRICS_TOKEN | Empty | Scrape token for /metrics |
Resources
| Setting | Default | Description |
|---|---|---|
RST_GATEWAY_CPUS, RST_GATEWAY_MEM | 2, 2g | CPU and memory limits of the gateway container |
RST_STATE_DB | /app/state/copilot.db | Path of the SQLite state database inside the container |
SSO settings are described in SSO.
Installing from the archive
Install the gateway with one command or from a downloaded archive, install on an air-gapped host, answer the deploy.sh prompts, verify the install, and install without deploy.sh.
QRadar token permissions
Create a dedicated authorized service for the gateway. The security profile decides which log sources and offenses are visible; the user role decides which APIs can be called. With the permission for each API, verification and the log-source whitelist.