Appendix A. Action index
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
Every action an operator can take in Lawliet 1.5.13.s - on the server's command line, on a monitored host, and in every page, tab, button, menu, dialog, form, toggle, export and data-changing filter of the console - with where it is, the permission it needs, whether a second administrator must approve it, and the section of this guide with its step-by-step procedure.
A.1 How to read this index#
| Column | Meaning |
|---|---|
| Action | What you want to do. Related buttons on the same screen share a row |
| Where | Sidebar entry > Page or tab > Control, with the exact labels on screen; a command for the CLI and host rows |
| Permission | The role-editor name of the permission (Appendix B). "Administrator role" means a built-in administrator-level role. "-" means any signed-in user |
| Four-eyes | "yes (<critical action>)" when a second administrator must approve it with the default policy; "policy (off by default)" when your policy may turn it on; "no" when it never does; "-" for screens that only show information |
| Guide section | The section with the procedure: numbered steps, what you see, and what to do if it fails. For a screen that only shows information, the section that describes it; opening it is the path itself |
How it was made. The index was built from the code of release 1.5.13.s, not from memory: every <button>, check box, confirmation question and download in the console's pages and components (about 630 controls on 57 routes), every write call the console makes to the server (about 190 distinct ones), every ./lawliet command and option, and the agent installers. Controls that only move around a list (paging, closing a panel, Retry after a load error) are not listed separately. Each row was then matched to a procedure; where none existed, the procedure was written into its chapter. Objects that can be created are listed again in A.25 with how each is viewed, changed, paused and removed - or what to do where the console has no such button.
Contents: A.2 CLI, A.3 hosts, A.4 sign-in, A.5 Overview, A.6 Environment, A.7 Assets and Stories, A.8 Compliance, A.9 Hardening, A.10 Evidence, A.11 Operations, A.12 Review queue, A.13 Forensics, A.14 Defense, A.15 Honeypots, A.16 FIM, A.17 Logs, A.18 DLP, A.19 Network, A.20 Firewall, A.21 AD assessment, A.22 Playbooks, A.23 Approvals, A.24 Settings, A.25 lifecycle, A.26 not in the console.
A.2 The ./lawliet command#
Run in the installation directory as root (sudo). None of these goes through four-eyes: whoever has root on the server has full control of it (9.4).
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
Install Lawliet (install) | sudo ./lawliet install | Root on the server | no | 2: Step by step |
Show health, licence, schema, estate size (status, st) | sudo ./lawliet status | Root on the server | no | 3.3 status |
Start everything or one service (start [service], up) | sudo ./lawliet start | Root on the server | no | 3.4 start |
Stop the containers, data untouched (stop [service], down) | sudo ./lawliet stop | Root on the server | no | 3.5 stop |
Restart and wait for health (restart [service]) | sudo ./lawliet restart | Root on the server | no | 3.6 restart |
Read logs (logs [service] [-f] [-n N]) | sudo ./lawliet logs backend -f | Root on the server | no | 3.7 logs |
Take a database backup (backup [dir]) | sudo ./lawliet backup | Root on the server | no | 5.2 Take a backup now |
| Schedule backups and copy them off the server | cron + backup | Root on the server | no | 5.3 Schedule backups and copy them off the server |
Restore a dump (restore <dump>) | sudo ./lawliet restore <dump> | Root on the server | no | 5: Procedure |
| Restore onto a new server | install then restore | Root on the server | no | 5: Procedure |
| Test a backup | restore on a test server | Root on the server | no | 5.6 Test your backups |
Update from a bundle, a delta or a directory (update <file>, upgrade) | sudo ./lawliet update <file> | Root on the server | no | 4.3 Update from a file (the standard route) |
Install the update the console staged (update --staged) | sudo ./lawliet update --staged | Root on the server | no | 4: Route A: upload a bundle (air-gapped sites) |
Skip the certificate check after an update (update --no-cert-repair) | update <file> --no-cert-repair | Root on the server | no | 4.3 Update from a file (the standard route) |
| Apply a delta update | update <delta> | Root on the server | no | 4.7 Delta updates |
Roll back the last update (rollback [--yes] [--to DIR] [--backup DUMP]) | sudo ./lawliet rollback | Root on the server | no | 4: Procedure |
Diagnose (doctor, diagnostics) | sudo ./lawliet doctor | Root on the server | no | 7: Report only |
Apply the safe fixes (doctor --fix [--yes]) | sudo ./lawliet doctor --fix | Root on the server | no | 7: Apply the safe fixes |
Make the redacted support archive (diag [--since 24h] [--output P] [--lines N] [--keep-emails]) | sudo ./lawliet diag | Root on the server | no | 7.2 diag |
Show the enrolment secret and install commands (token) | sudo ./lawliet token | Root on the server | no | 3.15 token |
Replace the enrolment secret (token --rotate) | sudo ./lawliet token --rotate | Root on the server | no | 16.6 The enrolment secret and enrolment codes |
Make an offline agent package (agent-package --os linux|windows [--arch] [--hosts] [--days] [--label] [--server] [--out]) | sudo ./lawliet agent-package --os linux | Root on the server | no | 11.3.2 Or make the package on the server |
Make the Windows MSI and transform for Group Policy (agent-package --os windows --gpo) | sudo ./lawliet agent-package --os windows --gpo | Root on the server | no | 12.4 Group Policy: make the rollout package |
Reset the installation administrator's password, or turn its two-factor off (passwd) | sudo ./lawliet passwd | Root on the server | no | 3.17 passwd |
Check the certificate (tls status, tls) | sudo ./lawliet tls status | Root on the server | no | 6: On the server |
Export the certificate for agent hosts (tls --export [path]) | sudo ./lawliet tls --export | Root on the server | no | 6.3 Export the certificate for agent hosts |
Install a certificate from your CA (tls, cert) | sudo ./lawliet tls | Root on the server | no | 6: Procedure |
Re-issue the self-signed certificate (tls repair [--yes] [--force] [--timeout S] [--ack P] [--allow-public-root]) | sudo ./lawliet tls repair | Root on the server | no | 6: With agents enrolled |
Hand a public CA's root to agents (--allow-public-root) | tls / tls repair | Root on the server | no | 6: Handing a public CA's root to agents |
Withdraw a staged certificate (tls cancel) | sudo ./lawliet tls cancel | Root on the server | no | 6.7 Withdraw a staged certificate (tls cancel) |
Turn encryption off (tls off) | sudo ./lawliet tls off | Root on the server | no | 6: Turn encryption off |
Turn encryption on (tls on) | sudo ./lawliet tls on | Root on the server | no | 6: Turn encryption on |
| Move a plain-HTTP install to HTTPS | tls on and agent reinstall | Root on the server | no | 6.9 Move a plain-HTTP install to HTTPS |
Show the licence and fingerprint, or install a key (licence [key], license) | sudo ./lawliet licence | Root on the server | no | 2: Step 2: install the key you receive |
Delete containers and volumes (uninstall) | sudo ./lawliet uninstall | Root on the server | no | 3.21 uninstall |
Show the version, or the help (version, --version, help) | ./lawliet version | Root on the server | no | 3.22 version and help |
Add an address the server answers to (TRUSTED_HOSTS) | .env, then start | Root on the server | no | 8.9 Add an address to TRUSTED_HOSTS |
| Check and fix the server clock | timedatectl | Root on the server | no | 8: Check and fix the server clock |
A.3 On the monitored hosts#
Run as root (Linux, macOS) or as Administrator (Windows) on the host. A protected agent needs an uninstall code or the recovery key to be removed.
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Linux: install with the copy-paste command | Shell on the host | Root on the host | no | 11.2 Procedure: install with the copy-paste command |
| Linux: install from an offline package | Shell on the host | Root on the host | no | 11.3.3 Install the package on the host |
Linux: installer options (--server, --token, --ca-cert, --reset-token, --refresh-ca, ...) | install_linux.sh | Root on the host | no | 11.4 Installer options |
| Linux: status, log, restart; files and services | systemctl, journalctl | Root on the host | no | 11.5 Managing the agent on the host |
| Linux: upgrade or repair by re-running the installer | install_linux.sh | Root on the host | no | 11.5 Managing the agent on the host |
| Linux: uninstall the agent | install_linux.sh --uninstall | Root on the host | no | 11.6 Procedure: uninstall the agent |
Linux and macOS: change agent settings (config.env) | /opt/lawliet-agent/config.env | Root on the host | no | 10.5 Agent configuration on the host |
| macOS: install, status, log, uninstall, new certificate | install_macos.sh, launchctl | Root on the host | no | 11.7 macOS |
| Windows: install with the copy-paste command | Elevated PowerShell | Administrator on the host | no | 12.2 Procedure: install with the copy-paste command |
| Windows: install from an offline package (ZIP) | Elevated PowerShell | Administrator on the host | no | 12.3 Procedure: install from an offline package (ZIP) |
| Windows: roll out with Group Policy Software installation (MSI) | Group Policy Management | Domain administrator | no | 12.5 Procedure: Group Policy with Software installation (MSI) |
| Windows: roll out with a computer startup script | Group Policy Management | Domain administrator | no | 12.6 Procedure: Group Policy with a computer startup script |
| Windows: MSI upgrade and removal, exit codes, event log | msiexec | Administrator on the host | no | 12.7 MSI results, upgrades and removal |
| Windows: prepare hosts for WinRM over HTTPS (5986) | Elevated PowerShell | Administrator on the host | no | 12: WinRM over HTTPS on 5986 (recommended) |
| Windows: prepare hosts for WinRM over plain HTTP (5985, insecure) | Elevated PowerShell | Administrator on the host | no | 12: WinRM over plain HTTP on 5985 (insecure) |
| Windows: uninstall the agent | install_windows.ps1 -Uninstall | Administrator on the host | no | 12.9 Procedure: uninstall the agent |
| Windows: installer parameters; status, log, restart, repair | install_windows.ps1, Get-ScheduledTaskInfo | Administrator on the host | no | 12.10 Installer parameters (install_windows.ps1) |
| Any OS: uninstall a protected agent with an uninstall code | --uninstall --code / -Uninstall -Code | Root / Administrator, plus a code (Delete agents) | no | 16.3 Uninstall codes |
| Any OS: uninstall a protected agent with the recovery key | --recovery-key / -RecoveryKey | Root / Administrator, plus the key | no | 16.4 The recovery key |
| Any OS: give an agent a new server certificate by hand | --refresh-ca / -RefreshCa | Root on the host / Administrator on the host | no | 16.7 When the server certificate changes |
| Any OS: fix the host clock | NTP / w32tm /resync | Root on the host / Administrator on the host | no | 10.6 Host clocks |
| Any OS: a host does not appear or goes offline | Host and console | Root on the host / Administrator on the host | no | 10.9 If a host does not appear or goes offline |
A.4 Sign-in and your own account#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Sign in with a local account | Sign in page > Sign in | - | no | 2: Step 1: sign in |
| Enter the authenticator code | Sign in page > Verify | - | no | 2: Step 1: sign in |
| Sign in with a recovery code | Sign in page > Use a recovery code | - | no | 15.1 First sign-in of a local account |
| Sign in with a directory (AD) account | Sign in page > Sign in with directory account | - | no | 14.2 Procedure: set up directory sign-in |
| Sign in with Windows (Kerberos) | Sign in page > Sign in with Windows (Kerberos) | - | no | 14.4 Procedure: Windows sign-in (Kerberos single sign-on) |
| Ask for a password reset link; set the new password | Sign in page > Forgot? > Send link; Reset password page | - | no | 15: Procedure: a user forgot their password |
| Set a new password at first sign-in | Set a new password > Set password | - | no | 2: Step 2: set a new password |
| Change your own password at any time | https://<server>/change-password > Set password | - | no | 15: Procedure: change your own password |
| Turn on two-factor; copy or download the recovery codes | Two-factor page > Copy, Download, Turn on two-factor authentication | - | no | 2: Step 3: turn on two-factor authentication |
| Activate a licence on the activation screen | Activation screen > Activate licence | Manage the licence | yes (Change the licence) | 2: Step 2: install the key you receive |
| Sign out; switch theme; hide the sidebar; filter modules | Sidebar and header | - | no | 20: Everyday controls |
| Read and clear notifications; open notification settings | Header > bell > Mark all read, gear | - | no | 20.5 The notification bell |
| Send a request for approval from any module | <action> needs a second signature > Send for approval | The action's permission | as the action | 20.4 Four-eyes from inside a module |
A.5 Overview and the wall#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Read the Overview | Overview | View the overview | - | 20.6 The Overview page |
| Refresh the Overview | Overview > freshness stamp | View the overview | - | 20.6 The Overview page |
| Run the protection drills now | Overview > Proof of protection > Run drills now | Manage agents | no | 20: Procedure: run the drills now |
| Open and leave the wall | Overview > Wall mode / Exit wall | View the overview | - | 20.8 The wall (full-screen operations view) |
| Integrate a detected domain | Overview > Domains detected > Integrate (disabled: "Coming soon") | - | - | 20.6 The Overview page |
A.6 Environment: hosts, installation, remote deployment, agent versions#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the hosts; filter by name or status | Environment > Hosts > Filter, status buttons | View agents | - | 10.4 The Environment page |
| Open a host's drawer | Environment > Hosts > row | View agents | - | 10: The agent drawer |
| Get the install command for Linux, macOS or Windows | Environment > Hosts > Install agent > Install command > OS > copy | Manage agents | no | 11.2 Procedure: install with the copy-paste command |
| Request, create and download an offline package | Environment > Hosts > Install agent > Offline package > Request package, Check again, Create package, Download | Deploy agents remotely | yes (Deploy agents remotely) | 11.3.1 Make the package in the console |
| Revoke an enrolment code | Install agent > Offline package > Enrolment codes > Revoke | Deploy agents remotely | no | 16: Procedure: revoke an enrolment code |
| Open remote deployment from the install dialog | Install agent > Remote deployment > Open remote deployment | Manage deployment credentials | - | 13.6 Other ways into remote deployment |
| Reinstall plain-HTTP agents over HTTPS | Environment > Hosts > red banner > Show the HTTPS install command | Manage agents | no | 6.9 Move a plain-HTTP install to HTTPS |
| Run drills on one host | Host drawer > Proof of protection > Run drills now | Manage agents | no | 20: Procedure: run the drills now |
| Turn self-protection on | Host drawer > Self-protection > Turn on | Manage agents | no | 16: Procedure: turn self-protection on |
| Turn self-protection off | Host drawer > Self-protection > Turn off | Manage agents | no | 16: Procedure: turn self-protection off |
| Issue an uninstall code | Host drawer > Self-protection > Issue uninstall code | Delete agents | yes (Delete an agent) | 16.3 Uninstall codes |
| Issue a stop code (no host command accepts it in this release) | Host drawer > Self-protection > Issue stop code | Delete agents | yes (Delete an agent) | 16.3 Uninstall codes |
| Remove a host with no records | Host drawer > Remove agent > Remove | Delete agents | yes (Delete an agent) | 10.7 Removing a host from the console |
| Delete a host and all its records | Host drawer > Remove agent > Delete it and its records | Delete agents | yes (Delete an agent) | 10.7 Removing a host from the console |
| Keep a host's records, revoke its token | Host drawer > Remove agent > Keep the records: revoke its token | Delete agents | yes (Delete an agent) | 10.7 Removing a host from the console |
| Add a deployment credential (SSH or WinRM) | Environment > Hosts > Deploy agents remotely > Add credential > Save credential | Manage deployment credentials | only weakening WinRM settings | 13.2 Procedure: add a credential |
| Change a WinRM credential | Deploy agents remotely > Credentials > Edit > Save changes | Manage deployment credentials | only weakening WinRM settings | 13: Procedure: change or delete a credential |
| Delete a credential | Deploy agents remotely > Credentials > Delete | Manage deployment credentials | no | 13: Procedure: change or delete a credential |
| Test a credential against one host; cancel the test | Credentials > Test > Test connection; Approvals > Cancel test | Manage deployment credentials + Deploy agents remotely | yes (Deploy agents remotely) | 13.3 Procedure: test a credential against one host |
| Switch a credential back to HTTPS | Credentials > Edit | Manage deployment credentials | no | 13.7 Switch a credential back to HTTPS |
| Add, change or remove Kerberos realms; check the KDCs | Deploy agents remotely > Kerberos realms > Add realm / Edit realms, Add another realm, Remove realm, Save realms, Check KDCs | Manage deployment credentials | yes (Deploy agents remotely) to save | 13.4 Procedure: configure Kerberos realms |
| Deploy agents to a list of hosts | Deploy agents remotely > Deploy agents | Deploy agents remotely | yes (Deploy agents remotely) | 13.5 Procedure: deploy agents |
| Follow a deployment; show a host's checks | Deployment > Checks (N failed, M warnings) / Hide checks | Manage deployment credentials | - | 13.5 Procedure: deploy agents |
| Cancel the hosts of a deployment not yet started | Deployment > Cancel what has not started | Manage deployment credentials | no | 13.5 Procedure: deploy agents |
| Retry a failed or cancelled host | Deployment > host > Retry | Deploy agents remotely | yes (Deploy agents remotely) | 13.5 Procedure: deploy agents |
| See the fleet's versions and upgrade candidates | Environment > Agent versions | Manage agents | - | 10.8 Agent versions and upgrades |
| Import the agents shipped in the bundle | Agent versions > Import bundled agents | Publish agent releases | no | 10: Procedure: upgrade agents on an air-gapped site |
| Register a release by hand; upload its artefact | Agent versions > Register a release > Register as draft; Upload artefact | Publish agent releases | no | 10: Procedure: register a release by hand |
| Publish a release | Agent versions > release > Publish | Publish agent releases | yes (Publish an agent release) | 10: Procedure: upgrade agents on an air-gapped site |
| Roll a release out to ten hosts | Agent versions > release > Roll out 10 | Publish agent releases | yes (Publish an agent release) | 10: Procedure: upgrade agents on an air-gapped site |
| Upgrade one host | Agent versions > Upgrade candidates > Upgrade to <version> | Publish agent releases | yes (Publish an agent release) | 10: Procedure: upgrade one host, stop a rollout, retire a release |
| Unpublish a release | Agent versions > release > Unpublish | Publish agent releases | no | 10: Procedure: upgrade one host, stop a rollout, retire a release |
| Delete a release | Agent versions > release > Delete | Publish agent releases | no | 10: Procedure: upgrade one host, stop a rollout, retire a release |
A.7 Assets and Stories#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the asset inventory and a host's risk | Assets; filters Criticality, Environment, Internet-exposed only, High risk only | View agents | - | 38.1 The Assets page |
| Create asset profiles for every agent | Assets > Sync from agents | Manage agents | no | 38: Procedure: classify your assets |
| Set an asset's criticality and environment | Assets > row | Manage assets | no | 38: Procedure: classify your assets |
| Read the stories; filter the window and multi-module hosts | Stories > Window, Only hosts seen by two or more modules | View the review queue | - | 38.2 The Stories page |
| Open an investigation from a story | Stories > host > Open an investigation | Run forensics | no | 38: Procedure: turn a story into an investigation |
A.8 Compliance#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See frameworks, scan history, active scans | Compliance > Overview | View compliance | - | 22.1 What the Overview tab shows |
| Run a scan on all or selected agents | Compliance > Overview > Run compliance scan > Run scan on ... | Run scans | no | 22.2 Procedure: run a scan |
| Choose a framework from the registry | Compliance > Overview > Framework registry > Select | View compliance | - | 22.2 Procedure: run a scan |
| Open a scan; filter its controls; read a control's evidence | Compliance > scan > filter buttons, Show all controls, Show all hosts, row | View compliance | - | 22.3 Reading a scan |
| Start hardening from the Fix plan | Scan > Fix plan > Start hardening (N) | Run hardening | no (the run waits for approval) | 22.4 Procedure: start hardening from the fix plan |
| Create a compliance schedule | Compliance > Schedules > New schedule > Save schedule | Run scans | no | 23: Procedure: create a schedule |
| Run a schedule now; disable or enable it; edit it; delete it | Compliance > Schedules > Run now, Disable/Enable, Edit, Delete > Yes | Run scans | no | 23: Procedure: run a schedule now, pause it, change it, delete it |
| Read drift; filter it; open a drift record | Compliance > Drift > filters, row | View compliance | - | 23.2 The Drift tab |
| Compare two scans on demand | Compliance > Drift > Compare scans on-demand > Compare | Run scans | no | 23: Procedure: compare two scans on demand |
| Find where a control fails (heatmap, cell detail, filters) | Compliance > Heatmap > filters > Apply, cell | View compliance | - | 24: Procedure: find where a control fails |
| Show the trend for a period (filters, Apply, Reset) | Compliance > Trends > Filters | View compliance | - | 24: Procedure: show the trend for an audit period |
| Record an attestation | Compliance > Attestations > New attestation > Record attestation | Run scans | no | 25: Procedure: record an attestation |
| Revoke an attestation | Compliance > Attestations > Revoke | Run scans or Manage compliance | no | 25: Procedure: revoke an attestation |
| Request an exception | Compliance > Attestations > exceptions > Request exception > Submit request | View compliance | no (no effect until approved) | 25: Procedure: request an exception |
| Approve or revoke an exception | Compliance > Attestations > exceptions > Approve / Revoke | Manage compliance | built in: never the requester | 25: Procedure: approve or revoke an exception |
| Generate a report now and download it | Compliance > Reports > Generate now, Download | View compliance | no | 25: Procedure: generate a report now |
| Schedule a report | Compliance > Reports > New schedule > Create schedule | Manage reports | no | 25: Procedure: schedule a report |
| Change or delete a report schedule | Compliance > Reports > Delete schedule <name> | Manage reports | no | 25: Procedure: change or stop a report schedule |
A.9 Hardening#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See runs; filter by ID, framework, status; open a run | Hardening > filters, Details | View hardening | - | 26.1 What the Hardening page shows |
| Approve and execute a run | Hardening > run > Approve & Execute > Confirm and execute | Run hardening | yes (Execute remediation) | 26.2 Procedure: approve and execute a run |
| Roll back a run | Hardening > run > Rollback > Confirm rollback | Run hardening | yes (Execute remediation) | 26.3 Procedure: roll back a run |
| Cancel a run | Hardening > run > Cancel > Confirm cancel | Run hardening | no | 26.4 Procedure: cancel a run |
| Issue and download a recovery artifact | Hardening > Recovery / break-glass > Issue, Download once | Run hardening | yes (Execute remediation) | 26: Procedure: issue and download a recovery artifact |
| Open failed steps in the review queue | Hardening > View in review queue | View the review queue | - | 26.1 What the Hardening page shows |
A.10 Evidence#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See bundles; filter; open details | Evidence > filters, View details | View evidence | - | 27.1 What you see |
| Create a bundle | Evidence > New evidence bundle > Create bundle | Run scans | no | 27.2 Procedure: create a bundle |
| Export a bundle as JSON or HTML | Evidence > Export JSON / Export HTML | View evidence | no | 27.3 Procedure: export and hand over |
| Verify an exported JSON file | API POST /api/v1/evidence/verify | View evidence (API key) | no | 27.4 Verify an exported JSON file |
| Delete a bundle | Evidence > Delete bundle > confirm | Delete evidence | no | 27.5 Procedure: delete a bundle |
A.11 Operations#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Run a framework scan, discover network assets, scan paths for sensitive data, verify or baseline an agent | Operations > Operation > fields > button | Administrator role; plus the module permission | no | 39: Procedure: run an operation |
| Auto-remediate an incident | Operations > Auto-remediate an incident > Remediate | Administrator role; Execute containment | yes (Run a containment action) | 39: Procedure: run an operation |
| Clear the execution log | Operations > Execution log > Clear | Administrator role | no | 39: Procedure: run an operation |
A.12 Review queue#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the queue; filter by module, status, severity, priority; clear filters | Review queue > module chips, filters, Clear all x | View the review queue | - | 21.1 What you see |
| Change status, assign (or Assign to me), comment, resolve, accept risk, suppress | Review queue > item > Actions | Work the review queue | no | 21.2 Procedure: work an item |
| Move an item by dragging it to another lane | Review queue > board | Work the review queue | no | 21: Moving items on the board |
| Isolate a host from a tamper or silence item | Review queue > item > Isolate this host | Execute containment | yes (Run a containment action) | 21: Procedure: isolate a host from a tamper or silence item |
| Follow a context link (deploy an agent, open the credential) | Review queue > item > Deploy an agent to this host, Open the credential | The target page's permission | - | 21.2 Procedure: work an item |
A.13 Forensics and IOC hunts#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the investigation queue | Forensics | View forensics | - | 34.1 The Forensics page |
| Open a case | Forensics > New investigation > Open case | Run forensics | no | 34: Procedure: open a case |
| Read a case (Overview tab, recent runs, findings) | Forensics > case > Overview | View forensics | - | 34.2 The case workspace |
| Run live-response collectors; open their records | Case > Live response > Run collectors, Open | Run forensics | no | 34: Procedure: run live response |
| Collect files, build a triage package, capture memory | Case > Triage & files > Collect files / Build triage package / Capture memory | Run forensics | no | 34: Procedure: collect files, a triage package or memory |
| Attach a file from your computer | Case > Triage & files > Choose file | Run forensics | no | 34: Procedure: attach a file from your computer |
| Browse artifacts and their chain of custody | Case > Artifacts > item; Table / Raw JSON | View forensics | - | 34.4 Artifacts and chain of custody |
| Download an artifact | Case > Artifacts > item > Download | Run forensics | no | 34: Procedure: download an artifact |
| Filter and export the super-timeline | Case > Timeline > Apply, CSV, JSON, Load the next N | View forensics (export: Run forensics) | no | 34: Procedure: filter and export the timeline |
| Start an IOC hunt (indicators, Load file, Parse on server, YARA Validate, targets) | Forensics > IOC hunts > New hunt > Start hunt (or case > Hunt) | Run forensics | no | 34: Procedure: start a hunt |
| Stop a hunt; export its results | Hunt > Cancel hunt, CSV, JSON, Refresh | Run forensics | no | 34: Procedure: stop a hunt or export its results |
| Take a response action on a case host; undo it | Case > Response > Run; undo in Actions in this case | Execute containment | yes (Run a containment action) | 34.7 Response from a case |
A.14 Defense#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the engine, the catalog and dispatched actions | Defense | View active defence | - | 36.1 What the Defense page shows |
| Dispatch a containment action (isolate, block, kill, quarantine, disable account, reset credentials) | Defense > Remediation actions > action > Dispatch action | Execute containment | yes (Run a containment action) | 36.3 Procedure: dispatch a containment action |
| Undo an action (also under Still in place on hosts) | Defense > Dispatched actions > Undo (<action>) | Execute containment | yes (Run a containment action) | 36.4 Procedure: undo an action |
| Run a command on a host | Defense > Run a command > Review and run > Yes, run it via <interpreter> | Execute containment (and DEFENSE_ALLOW_CUSTOM_COMMANDS=true) | yes (Run a containment action) | 36.5 Run a command (operator live response) |
A.15 Honeypots#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See decoys and trips; filter trips | Honeypots | View honeypots | - | 35.2 What the Honeypots page shows |
| Create a decoy | Honeypots > New decoy > Create decoy | Manage honeypots | no | 35.3 Procedure: create and deploy a decoy |
| Deploy a decoy to its hosts | Honeypots > decoy > Deploy | Manage honeypots | no | 35.3 Procedure: create and deploy a decoy |
| Undeploy a decoy | Honeypots > decoy > Undeploy | Manage honeypots | no | 35.6 Procedure: undeploy or delete a decoy |
| Delete a decoy | Honeypots > decoy > Delete | Manage honeypots | no | 35.6 Procedure: undeploy or delete a decoy |
| Handle a trip (Acknowledge, Resolve, False positive) | Honeypots > Trips > trip > Set status | Manage honeypots | no | 35.4 Procedure: handle a trip |
| Turn on auto-contain for a decoy | New decoy > Auto-contain the source on a trip | Manage honeypots | no (turning it on is the authorisation) | 35.3 Procedure: create and deploy a decoy |
| Lift an automatic block | Defense > Dispatched actions > Undo (unblock address) | Execute containment | yes (Run a containment action) | 36.4 Procedure: undo an action |
A.16 File integrity monitoring (FIM)#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See changes; filter by path and severity | FIM > Changes | View FIM | - | 33.4 Working the changes |
| Create a FIM policy (template, validation) | FIM > Policies > New policy > Create policy | Manage FIM | no | 33.2 Procedure: create a FIM policy |
| Change a FIM policy | FIM > Policies > policy name > Save changes | Manage FIM | no | 33: Procedure: change, disable or delete a FIM policy |
| Disable or enable a FIM policy | FIM > Policies > Disable / Enable | Manage FIM | no | 33: Procedure: change, disable or delete a FIM policy |
| Delete a FIM policy | FIM > Policies > Delete | Manage FIM | no | 33: Procedure: change, disable or delete a FIM policy |
| Build a baseline; browse it | FIM > Agents and baselines > Baseline now; Baseline cell | Manage FIM | no | 33: Procedure: build a baseline |
| Verify one host or every host of a policy | FIM > Agents and baselines > Verify now; Policies > Verify all agents | Manage FIM | no | 33: Procedure: verify a host against its baseline |
| Accept verified changes into the baseline | Verification result > Accept / Accept all N change(s) into the baseline | Manage FIM | no | 33: Procedure: accept verified changes into the baseline |
| Triage a change | FIM > Changes > event > Set status > Save | Triage findings | no | 33: Procedure: triage a change |
| Accept one change into the baseline | FIM > Changes > event > Accept into baseline | Manage FIM | no | 33: Procedure: accept a change into the baseline |
A.17 Logs#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Search logs (query, time range, custom range, severity, break down, Only/Exclude a value, chart or table, paging) | Logs > Search > Search | Search logs | - | 30: Procedure: investigate failed logins for one account |
| Save a search | Logs > Search > Save search > Save | Search logs | no | 30: Procedure: investigate failed logins for one account |
| Delete a saved search | Logs > Search > Saved > x (Delete saved search <name>) | Search logs | no | 30: Procedure: delete a saved search |
| Turn a search into a rule | Logs > Search > Make this a rule | Manage detection rules | no | 31.2 Procedure: create a detection rule |
| Build a dashboard (also from a search: Add to dashboard) | Logs > Dashboards > New dashboard > Add panel > Save dashboard | Search logs | no | 30: Procedure: build a dashboard |
| Change, copy, delete a dashboard; copy a built-in one | Logs > Dashboards > Edit, Copy, Delete dashboard, Copy to edit | Search logs | no | 30: Procedure: change, copy or delete a dashboard |
| Add a syslog source | Logs > Sources > Add source > Create | Manage log sources | no | 30: Procedure: add a syslog source |
| Add an HTTP shipper and store its token | Logs > Sources > Add source > Create > Copy token > I have stored it | Manage log sources | no | 30: Procedure: add an HTTP shipper |
| Delete a source | Logs > Sources > Delete <name> | Manage log sources | no | 30: Procedure: delete a source |
| Create a detection rule (preview, test on sample lines) | Logs > Rules > New rule > Preview, Run test, Create rule | Manage detection rules | no | 31.2 Procedure: create a detection rule |
| Change a rule | Logs > Rules > rule name > Save as new version | Manage detection rules | no | 31: Procedure: change a rule |
| Enable, disable or run a rule now | Logs > Rules > Enable / Disable, Run <rule> now | Manage detection rules | no | 31: Procedure: enable, disable or run a rule now |
| Restore an earlier version of a rule | Logs > Rules > History of <rule> > Restore vN as a new version | Manage detection rules | no | 31: Procedure: restore an earlier version |
| Delete a rule | Logs > Rules > Delete <rule> | Manage detection rules | no | 31: Procedure: delete a rule |
| Triage alerts in bulk (status, assign) | Logs > Alerts > tick > Set status, Assign selected | Work the review queue | no | 31: Procedure: triage alerts in bulk |
| Escalate alerts to an investigation | Logs > Alerts > tick > Escalate | Run forensics | no | 31: Procedure: escalate alerts to an investigation |
| Work one alert (triage, assign, suppress its subject, escalate, search around it) | Logs > Alerts > alert | Work the review queue / Manage detection rules / Run forensics | no | 31: Procedure: work one alert |
| Install Sigma rules from the pack | Logs > Sigma > Rule pack > Install selected | Manage detection rules | no | 31: Procedure: install rules from the pack |
| Translate and import your own Sigma YAML | Logs > Sigma > Paste YAML > Translate, Import N | Search logs (translate); Manage detection rules (import) | no | 31: Procedure: import your own Sigma YAML |
| Rank entities; recompute scores | Logs > Entities > Find, Recompute | Search logs (Recompute: Manage detection rules) | no | 31.5 The Entities tab |
| See ATT&CK coverage; jump to rules or Sigma | Logs > ATT&CK > technique > Rules for <technique>, Find a Sigma rule | Search logs | - | 31.6 The ATT&CK tab |
A.18 Data loss prevention (DLP)#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See and filter incidents | DLP > Incident queue | View DLP | - | 32.2 Incidents |
| Triage an incident | DLP > incident > Set status > Save | Triage findings | no | 32: Procedure: triage an incident |
| Create a DLP policy (rules, channel actions, device control, egress programs, Reset to built-in list, Test text) | DLP > Policies > New policy > Save policy | Manage DLP | no | 32: Procedure: create a DLP policy |
| Change, disable or delete a DLP policy | DLP > Policies > row; Enabled; bin | Manage DLP | no | 32: Procedure: change, disable or delete a DLP policy |
| Run a discovery scan; export the inventory (CSV, JSON) | DLP > Discovery > Start scan | Manage DLP (export: View DLP) | no | 32: Procedure: run a discovery scan |
| Schedule discovery | DLP > Discovery > Scheduled discovery > New schedule > Save schedule | Manage DLP | no | 32: Procedure: schedule discovery |
| Run, change, pause or delete a discovery schedule | DLP > Discovery > schedule > Run now, row, disable/enable, Delete | Manage DLP | no | 32: Procedure: run, change, pause or delete a discovery schedule |
| Find a file across hosts | DLP > Where is this file > Search | Manage DLP | no | 32.5 Where is this file |
| Read a host's enforcement status | DLP > Enforcement status > Select host... | View DLP | no | 32.6 Enforcement status |
A.19 Network#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the map, nodes, discovery runs; filter the inventory | Network | View network | - | 28.1 What the Network page shows |
| Use the map (find, zoom, fit, node detail) | Network > map | View network | - | 28.2 Using the topology map |
| Rescan one host | Network > node > Rescan now | Manage network | no | 28: Procedure: rescan one host |
| Run a server-side discovery scan (Plan scope, Run scan) | Network > Trigger server-side network scan | Manage network | no | 28.3 Procedure: run a server-side discovery scan |
| Remove the hidden internet endpoints | Network > Remove them | Manage network | no | 28: Procedure: remove the hidden internet endpoints |
| Seed or clear sandbox topology (sandbox accounts) | Network > Sandbox / Demo topology > Seed sandbox topology / Clear sandbox topology | Manage demo data | policy (off by default) | 28.4 Sandbox topology |
| Read internet exposure per host | Network > Exposure | View network | - | 28.5 The Exposure page |
| Export the topology (Report, JSON, CSV; redaction options) | Network > Export topology > Download <FORMAT> | View network | no | 28.6 Procedure: export the topology |
A.20 Firewall#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See the devices list | Firewall | View firewall | - | 29.2 The devices list |
| Connect a live firewall | Firewall > Connect a firewall > Connect, test and read | Manage firewall | no | 29: Procedure: connect a live firewall |
| Import a configuration file | Firewall > Import a configuration > Import | Manage firewall | no | 29: Procedure: import a configuration file |
| Test the connection; read the policy again | Device > Test connection, Read now (also on the list row) | Manage firewall | no | 29: Procedure: test the connection and read the policy again |
| Stop using a device (no remove button) | Device > Monitor > Stop monitoring; disable the account on the device | Manage firewall | no | 29: Removing a device |
| Read the policy and the findings; compliance mapping | Device > Policy, Findings | View firewall | - | 29.4 Findings |
| Make an optimisation plan | Device > Optimise > Plan all M safe fixes / Plan the N chosen fixes | Manage firewall | no | 29.5 Procedure: make an optimisation plan |
| Apply a plan to the firewall; approve, reject, run it | Device > Apply > Request apply; Approve / Reject; Run the approved apply | Push firewall policy | yes (Push a firewall policy) | 29.6 Procedure: apply a plan to the firewall (four-eyes) |
| Compare two versions | Device > Versions > tick two | View firewall | - | 29: Procedure: compare two versions |
| Set the baseline | Device > Versions > Set as baseline | Manage firewall | no | 29: Procedure: set the baseline |
| Download the configuration or a plan (script, full config, model JSON) | Device > Export | View firewall | no | 29: Procedure: export a configuration or a plan |
| Start or stop live monitoring | Device > Monitor > Start monitoring / Stop monitoring | Manage firewall | no | 29: Procedure: start or stop live monitoring |
| Count rule hits from logs | Device > Monitor > Count from logs | Manage firewall | no | 29: Procedure: count hits from logs |
A.21 AD assessment#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Register a domain | AD assessment > Register a domain > Add | Manage compliance | no | 14: Procedure: register a domain and collect |
| Collect a domain's objects and permissions | AD assessment > Collect permissions now | Manage compliance | no | 14: Procedure: register a domain and collect |
| Read coverage, findings, attack paths, compliance | AD assessment > tabs | View compliance | - | 14: The tabs |
| Deploy agents via GPO (does not install the agent in 1.5.13.s; use the MSI) | AD assessment > Coverage > Deploy agents via GPO | Write to Active Directory | yes (Write to Active Directory) | 14: Deploy agents via GPO (Coverage tab) |
A.22 Playbooks#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See playbooks and runs | Playbooks | View the review queue | - | 37.2 The Playbooks page |
| Create a playbook (trigger, steps, Add step, Up/Down/Remove, Dry run) | Playbooks > New playbook > Save playbook | Manage playbooks | no (containment steps always need a signature) | 37.3 Procedure: create a playbook |
| Change a playbook; switch it on or off | Playbooks > Edit; Enabled tick box | Manage playbooks | no | 37.5 Procedure: change, switch off or retire a playbook |
| Approve a waiting containment step; ask again | Approvals; run > Ask again | Approve critical actions; Manage playbooks | always | 37.4 Procedure: a containment step is waiting |
A.23 Approvals#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| See requests (Waiting for me, My requests, History) | Approvals | - | - | 15.6 Approvals |
| Approve or reject a request | Approvals > Waiting for me > request > Approve / Reject | Approve critical actions | - | 15: Procedure: approve or reject (the approver) |
| Execute an approved request | Approvals > My requests > request > Execute now | The action's permission | - | 15: Procedure: execute (the requester) |
| Withdraw your request | Approvals > My requests > request > Withdraw request | - | - | 15: Procedure: execute (the requester) |
A.24 Settings#
| Action | Where | Permission | Four-eyes | Guide section |
|---|---|---|---|---|
| Read deployment, licence, certificate, role permissions | Settings > Platform | Administrator role | - | 39.3 Settings > Platform |
| Activate or replace the licence | Settings > Platform > License > Enter a new licence key > Activate licence | Manage the licence | yes (Change the licence) | 2: Step 2: install the key you receive |
| Check the certificate again | Settings > Platform > Certificate > Check again | Administrator role (server details: Manage settings) | no | 6: In the console |
| Check for updates; download and verify one (update feed) | Settings > Platform > Platform updates > Check for updates, Download and verify | Manage platform updates | yes (Stage a platform update) | 4: Route B: the update feed |
| Upload an update bundle; discard a staged update; copy the apply command | Platform updates > Install from a file > Continue upload; Discard it | Manage platform updates | yes (Stage a platform update) | 4: Route A: upload a bundle (air-gapped sites) |
| Download diagnostics for support | Platform updates > Download diagnostics | Manage settings | no | 7.3 Diagnostics from the console |
| Decommission every agent (engagement close-out) | Settings > Platform > Engagement > Decommission all agents > Remove the agents | Delete agents | yes (Delete an agent) | 16.8 Removing every agent at the end of an engagement |
| Re-check the setup steps | Settings > Setup > Re-check | Administrator role | no | 39.4 Setup |
| Choose your notifications | Settings > Notifications > Save changes | - | no | 39.6 Settings > Notifications |
| Create a user | Settings > Users > Create user | Manage users | yes (Change users) | 15: Procedure: create a user |
| Change a user's role; disable or re-enable a user | Settings > Users > row > Save | Manage users | yes (Change users) | 15: Procedure: change a user's role, or disable or re-enable a user |
| Grant or deny single permissions | Settings > Users > Adjust > Save permissions | Manage users | yes (Change users) | 15: Procedure: grant or deny single permissions |
| Reset a user's two-factor | Settings > Users > Reset 2FA | Manage users | yes (Change users) | 15: Procedure: reset a user's two-factor |
| Delete a user | Settings > Users > Delete | Manage users | yes (Change users) | 15: Procedure: delete a user |
| Create a custom role (New role, Copy this role) | Settings > Access control > Roles > Create role | Manage roles | yes (Change roles) | 15: Procedure: create a custom role |
| Change or delete a custom role | Settings > Access control > Roles > Save role, Delete role | Manage roles | yes (Change roles) | 15: Procedure: change or delete a custom role |
| Change the dual-control policy | Settings > Access control > Dual control > Save policy / Discard changes | Configure dual control | always | 15.4 Dual control (four-eyes) |
| Set up directory sign-in (Test connection, group rules Add rule/Up/Down/Remove, CA Remove, Save changes) | Settings > Authentication | Manage users | yes (Change users) | 14.2 Procedure: set up directory sign-in |
| Sync directory users; apply held changes | Settings > Authentication > Sync now, Apply anyway | Manage users | yes (Change users) for held changes | 14.3 Procedure: directory sync |
| Set up Windows sign-in (keytab, Offer Windows sign-in, RC4, two-factor opt-out) | Settings > Authentication > Windows sign-in (Kerberos) > Upload keytab, Save | Manage users | yes (Change users) | 14.4 Procedure: Windows sign-in (Kerberos single sign-on) |
| Replace or remove the keytab; turn Windows sign-in off | Windows sign-in > Replace keytab, Remove keytab | Manage users | yes to replace; no to remove | 14: Procedure: replace or remove the keytab, or turn Windows sign-in off |
| Issue an API key; copy it once | Settings > API keys > New key > Create key > Copy key | Manage API keys | yes (Change API keys) | 15: Procedure: issue a key |
| Revoke an API key; show revoked keys | Settings > API keys > Revoke; Show revoked | Manage API keys | yes (Change API keys) | 15: Procedure: revoke a key |
| Add a SIEM destination; test it | Settings > SIEM forwarding > Add destination > Create destination; Test | Manage SIEM forwarding | policy (off by default) | 39: Procedure: add a destination |
| Change, pause or delete a SIEM destination | Settings > SIEM forwarding > name; Enabled; bin | Manage SIEM forwarding | policy (off by default) | 39: Procedure: change, pause or delete a destination |
| Read and filter the audit trail; open an event | Settings > Audit trail | View the audit trail | - | 15.8 Audit trail |
| Seed, re-seed or clear sandbox data | Settings > Sandbox > Seed sandbox data / Re-seed sandbox / Clear sandbox data | Manage settings + Manage demo data | policy (off by default) | 39.9 Settings > Sandbox |
A.25 Lifecycle of every object you can create#
For each kind of object an operator can create: where to create, view, change, pause and remove it. Where the console has no such button in this release, the cell says so and links to what to do instead.
| Object | Create | View | Change | Disable or pause | Delete or remove |
|---|---|---|---|---|---|
| Agent (host) | install | Hosts | host settings | revoke token | remove / delete, uninstall |
| Offline package / enrolment code | request | Install agent > Offline package | No edit: make a new one | revoke | Kept as a record (revoke instead) |
| Agent release | import / register | Agent versions | No edit: register a new one | unpublish | delete |
| Deployment credential | add | Credentials table | edit (WinRM) | - | delete |
| Kerberos realm | add | Kerberos realms | edit realms | - | remove realm |
| Deployment job | deploy | Deployments | retry a host | cancel what has not started | Kept as a record |
| User | create | Settings > Users | role, permissions, two-factor | inactive | delete |
| Custom role | create | Access control > Roles | save role | - | delete role |
| API key | issue | Issued keys | No edit: issue a new one | revoke | Kept as a record (revoked) |
| Approval request | By any critical action | Approvals | No edit: file a new one | withdraw | Kept in History |
| Compliance scan | run | scan page | No edit | none; scans time out | no delete: kept as the record |
| Compliance schedule | create | Schedules | edit | disable | delete |
| Attestation | record | Attestations | No edit: revoke and record again | revoke | Kept as a record |
| Exception | request | Attestations > exceptions | No edit: revoke and request again | revoke | Kept as a record |
| Report schedule | create | Reports | No edit: create the new one, delete the old | no pause: delete | delete |
| Generated report | generate | Reports | - | - | no delete in the console |
| Hardening run | start from Fix plan | Hardening | No edit | cancel, roll back | Kept as a record |
| Recovery artifact | issue | Recovery / break-glass | - | - | Purged after its one download |
| Evidence bundle | create | details | No edit: create a new one | - | delete |
| Network node | Agents and scans | map | rescan | - | no delete (hidden internet endpoints: remove them) |
| Firewall device | connect / import | Devices list | No edit: re-read or re-import | stop monitoring | no remove: do this instead |
| Firewall plan / version | make a plan | Versions | No edit: make a new plan | set another baseline | Kept as a record |
| Log source | add | Sources | No edit: add a new one | no pause: delete | delete |
| Saved search | save | Search > Saved | No edit: save again | - | delete |
| Dashboard | build | Dashboards | edit / copy | - | delete |
| Detection rule | create | Rules | save as new version | disable | delete |
| Alert suppression | suppress | - | - | - | lapses at its end; no early removal |
| DLP policy | create | Policy catalogue | edit | untick Enabled | delete (disable if it has incidents) |
| DLP discovery schedule | create | Scheduled discovery | edit | disable | delete |
| FIM policy | create | Policies | edit | disable | delete |
| FIM baseline | baseline now | Agents and baselines | accept changes | Disable its policy | Deleted with its policy |
| Forensic case | open | case workspace | No edit | - | no close or delete in the console |
| IOC hunt | start | IOC hunts | No edit: start a new one | cancel | Kept as a record |
| Decoy (honeypot) | create | Honeypots | no edit: replace it | undeploy | delete |
| Containment action | dispatch | Dispatched actions | - | undo | Kept as a record |
| Playbook | create | Playbooks | edit | untick Enabled | no delete: switch it off |
| Asset profile | sync from agents | Assets | criticality, environment | - | no delete in the console |
| AD domain | register | AD assessment | - | Stop collecting | no remove in the console |
| SIEM destination | add | SIEM forwarding | edit | untick Enabled | delete |
| Review item, DLP incident, FIM event, trip, alert | By the modules | Review queue | status, assign, comment | suppress / accept risk | Never deleted by hand: close them |
| Sandbox data | seed | Settings > Sandbox | Re-seed | - | clear |
| Licence | activate | Settings > Platform | enter a new key | - | Replaced by a new key |
| TLS certificate | install | check | replace / repair | tls off | withdraw a staged one |
| Backup | backup | backups/ directory | - | - | Delete old dump files by your own retention (5.3) |
| Installation | install | status | update | stop | uninstall |
A.26 Functions the console does not offer#
The server has a few functions that no console screen calls in this release. They are listed so that nobody looks for a button that does not exist.
| Function | In the console instead | Guide |
|---|---|---|
| Rotate one agent's token | Revoke the token (Remove agent > Keep the records: revoke its token); the API call is described in 16.5 | 16.5 |
| Reveal the recovery key | No console button; API call, once, by an administrator | 16.4 |
| Verify an exported evidence file | API call with a service-account key | 27.4 |
| Verify the audit trail's hash chain | API call by an auditor | 15.8 |
| Forget a pinned SSH host key | API call | 13.3 |
| Delete a generated report | None; reports are kept | 25.3 |
| Edit or pause a report schedule | Create the new one, delete the old one | 25.3 |
| Remove a firewall device | Stop monitoring; disable Lawliet's account on the device | 29.2 |
| Remove an AD domain; schedule AD collection; set an AD finding's status | None; collect on demand | 14.5 |
| Archive a DLP policy | Untick Enabled | 32.3 |
| Edit a log source; replace an HTTP shipper's token | Add a new source, move the sender, delete the old one | 30.5 |
| Rename a saved search | Save it again under the new name, delete the old one | 30.2 |
| Close or delete a forensic case | None; cases are kept with their chain of custody | 34.1 |
| Edit a decoy | Create a new decoy, then undeploy and delete the old one | 35.6 |
| Delete a playbook | Untick Enabled | 37.5 |
| Create or change business processes | None in this release | 38.1 |
| End an alert suppression early | None; it lapses at the end of its period | 31.3 |
| Set another user's password | Password reset link, or delete and re-create the account | 15.2 |
| Integrate a detected domain (Overview) | The button is disabled ("Coming soon"); use AD assessment | 14.5 |