-
Notifications
You must be signed in to change notification settings - Fork 0
Settings
The dashboard's Settings page lets you edit the commonly-tuned configuration
from inside the app instead of hand-editing secwatch.yaml.
Settings you save here are an overrides layer on top of your config file. The resolution order is:
environment variable > Settings page > secwatch.yaml > built-in default
So a UI edit wins over the YAML, but an explicit SECWATCH_* env var still wins
over the UI (handy for containers). Your hand-written secwatch.yaml stays the
declarative base — nothing rewrites it.
- Most settings apply immediately (detection thresholds, alerting, the LLM target — anything read fresh on each event/call).
- A few are read once at startup (enabling the scheduled LLM or CVE loops). Those
save right away but show a restart tag and take effect after
systemctl restart secwatch.
- Detection & bans — auto-ban master switch, instant-ban of secret-file probes, and the flood / scan / bot / credential-stuffing thresholds.
-
Alerting — Discord webhook URL, minimum severity, and the
quiet_rulesnoise filter (see Alerting). - LLM analysis — endpoint URL, model, API key, JSON mode, temperature, max tokens, alert threshold (see LLM Analysis).
- Vulnerability scanning — enable/disable, severities (see CVE Scanning).
Security-critical settings are intentionally not editable here — trusted_nets,
the ban actuator, and dashboard auth are shown read-only and can only be changed
in secwatch.yaml. Getting those wrong can lock you out or widen trust, so they
stay a deliberate file edit.
The webhook URL and LLM API key are stored encrypted on the box
(data/secrets.enc, encrypted with a chmod 600 key at data/settings.key).
The UI never shows a saved secret — only "set" / "not set", with a clear
button. Requires the cryptography package (installed by default); if it's
missing, the page tells you and secret fields are disabled.
Honest scope of "encrypted": to let secwatch start unattended, the decryption key lives on the same host as the ciphertext. This keeps secrets out of plaintext files and backups — it is not protection against someone who already has access to the host (they can read the key too). Treat it as at-rest hygiene, not a vault.
The Settings page can change where alerts go, point the LLM at a different
endpoint, and toggle detection — i.e. it can reconfigure secwatch itself. If
you reach secwatch directly over IP:PORT rather than through an authenticating
reverse proxy, turn on the built-in login (auth.enabled, see
Dashboard and Authentication) so this page isn't open to anyone who can
reach the port.