Settings

Settings

The dashboard's Settings page lets you edit the commonly-tuned configuration from inside the app instead of hand-editing secwatch.yaml.

How it layers

Settings you save here are an overrides layer on top of your config file. The resolution order is:

environment variable  >  Settings page  >  secwatch.yaml  >  built-in default

So a UI edit wins over the YAML, but an explicit SECWATCH_* env var still wins over the UI (handy for containers). Your hand-written secwatch.yaml stays the declarative base — nothing rewrites it.

Live vs. restart

• Most settings apply immediately (detection thresholds, alerting, the LLM target — anything read fresh on each event/call).
• A few are read once at startup (enabling the scheduled LLM or CVE loops). Those save right away but show a restart tag and take effect after systemctl restart secwatch.

What you can edit

• Detection & bans — auto-ban master switch, instant-ban of secret-file probes, and the flood / scan / bot / credential-stuffing thresholds.
• Alerting — Discord webhook URL, minimum severity, and the quiet_rules noise filter (see Alerting).
• LLM analysis — endpoint URL, model, API key, JSON mode, temperature, max tokens, alert threshold (see LLM Analysis).
• Vulnerability scanning — enable/disable, severities (see CVE Scanning).

Security-critical settings are intentionally not editable here — trusted_nets, the ban actuator, and dashboard auth are shown read-only and can only be changed in secwatch.yaml. Getting those wrong can lock you out or widen trust, so they stay a deliberate file edit.

Secrets

The webhook URL and LLM API key are stored encrypted on the box (data/secrets.enc, encrypted with a chmod 600 key at data/settings.key). The UI never shows a saved secret — only "set" / "not set", with a clear button. Requires the cryptography package (installed by default); if it's missing, the page tells you and secret fields are disabled.

Honest scope of "encrypted": to let secwatch start unattended, the decryption key lives on the same host as the ciphertext. This keeps secrets out of plaintext files and backups — it is not protection against someone who already has access to the host (they can read the key too). Treat it as at-rest hygiene, not a vault.

⚠ Exposing the dashboard

The Settings page can change where alerts go, point the LLM at a different endpoint, and toggle detection — i.e. it can reconfigure secwatch itself. If you reach secwatch directly over IP:PORT rather than through an authenticating reverse proxy, turn on the built-in login (auth.enabled, see Dashboard and Authentication) so this page isn't open to anyone who can reach the port.