Dashboard guide

Kill switch

The kill switch stops all changes in your environment at once. Use it when something goes wrong: a plan that causes damage, a suspected misuse of an account, or any doubt. Monitoring continues.

It is at the bottom of the sidebar, for owners and admins. Others see "Only admins of this environment can use the kill switch."

#Activate

1. Click Kill switch at the bottom of the sidebar.
2. Enter a reason (at least 5 characters; it goes into the audit log).
3. Type the confirmation word and click Activate kill switch.

What happens:

• The signing service stops signing jobs for your environment.
• A signed kill message goes to every connected agent. Each agent checks the signature itself and then refuses new jobs, and cancels jobs that are waiting, at a safe point. An agent that is offline gets the message when it reconnects, before anything else.
• Plans that are approved or running are set to paused.
• Agents keep reporting: inventory, findings and the attack surface stay up to date.
• The console shows a red banner KILL SWITCH ACTIVE with the reason, and the toast says how many agents were notified and how many plans were paused.

Note

A change that has already started on a host (for example a package installation) is not interrupted halfway; that would leave the host in a worse state. It finishes, and nothing new starts.

One owner or admin is enough to activate the kill switch: stopping must be fast.

#Release

1. Click Release… in the banner (or the kill switch button).
2. Confirm with Release kill switch.

The signing service signs jobs again. Paused plans stay paused until someone starts them again with Start wave N… on the plan, so nothing restarts by surprise.

Both activation and release are in the audit log, with who did it and why.