Dashboard guide
Settings
Settings (under Evidence) is for owners and admins; the server checks the role per change, and every change is in the audit log. The sections:
Users & roles
A read-only list of the members and their roles, with whether four eyes is possible ("Four eyes possible: N members can approve") or a notice that your environment has a single approver. Manage members under Access & SSO. Roles are explained in Roles and permissions.
Access & SSO
For every member:
- Your session: sign out, switch environment.
- Your security keys: your registered keys, each marked Synced passkey or Device-bound / hardware key, with Test key, Add security key and Remove. See Sign-in and security keys.
Owners and admins:
| Setting | Does |
|---|---|
| Members | Change a member's role, or Remove a member (with a step-up). |
| Approver list | The list of people who may approve. Update with your key… proposes a change; Confirm with your key… confirms it. A change needs two people who are already on the list. |
| Security key at sign-in | Owners and admins must use a key at every sign-in. On by default. |
| Approvals require a hardware (device-bound) key | Synced passkeys no longer count for approvals. Off by default. |
| Invitations | E-mail address and role, then Invite. The link is shown once and is valid 7 days. Only owners can invite owners. |
| Identity providers | Set up SSO: a wizard for OpenID Connect with presets for Microsoft Entra ID, Google, Okta, Keycloak/Authentik, or generic. Validate, Save as draft, Claim domain and Verify (a DNS TXT record proves the e-mail domain is yours), Run test login, then Activate or Disable. |
| Sign-in policy | SSO only (no passwords), Passkey required (a key for every member), and whether Microsoft, Google or Apple sign-in is allowed. |
Owners only: Approvals without a security key: Security key required (recommended, the default), … or re-authentication (a sign-in within 15 minutes also counts), or Typed confirmation only (weakest).
Enrollment tokens
The installation codes and enrollment tokens of your environment: who created them, for what profile, how often they were used, and until when they are valid. Revoke an unused one, Remove an old one, or Create token / add agent. See Install on Linux.
Policy
The profiles (observe, patch, full) explained, and the reminder that the host decides: each host's
/etc/sec/policy.toml is the upper limit. See Local policy.
SLA policy
The deadlines per risk class and the remediation policy of your environment: four eyes, the single-admin hold time, the canary share and failure threshold for waves, and how long a signed job stays valid.
Licence & seats
Your licence and how many agent seats are in use. A host cannot enroll when there are no free seats
(seat_exhausted).
Network segments, Probes & relays, External probe, Discovery
- Network segments: name your networks (for example office-lan 192.168.1.0/24). Segments are used for probes, discovery and the segment matrix on Attack surface.
- Probes & relays: hosts with the probe or relay role.
- External probe:
- Peer probes inside your organisation: Let my hosts test each other (on by default).
- External probing: Probe my public listeners from the internet (off by default), the probe agents, and Run now.
- Public (WAN) addresses: the addresses your agents use towards the internet; confirm the ones to probe.
- Own addresses: public addresses without an agent on them (for example a NAT firewall). They are probed only after Verify: publish a DNS TXT record or a token file on the host (port 80).
- Newest observations (7 days) and Runs. See External and internal probes.
- Discovery: settings for discovering devices without an agent on your own networks.
Notifications
Channels: e-mail, webhook, Slack, Microsoft Teams, Jira, TOPdesk, ConnectWise, Autotask and HaloPSA. Add channel, then Test.
Rules: which events go to which channel. The events come in three groups:
| Group | Events |
|---|---|
| Critical | a known exploited vulnerability (KEV) on your hosts, tampering on a host, a failed remediation, an autopilot rule that paused |
| Act now | new findings in Act now, urgent threat briefings |
| Operations | plans waiting for approval, new (pending) and offline agents, stale vulnerability data, a report that is ready, a failed domain check, autopilot activity, hosts without an agent (coverage gap), unmanaged devices and their findings, local policy changes, expiring agent credentials, agents that cannot update themselves |
An agent counts as offline after a threshold that you set here (default 30 minutes, 5 minutes to 7 days).
Delivery log: what was sent, with Retry for failed deliveries. Channel details, the webhook format and ticketing: Notifications and integrations.
Integrations
Read-only links with RMM tools (NinjaOne, N-central, Datto RMM; details in Notifications and integrations): compare their device list with your agents to find hosts without an agent (coverage gap), and get install scripts to roll the agent out through the RMM.
Domains
Let your agents connect through a name of your own domain (for example sek.example.com). Add domain shows a TXT
record (proof that the domain is yours) and a CNAME (the name points to SEK Systems). SEK Systems checks both with
several public resolvers, then gets a certificate for the name. Check now repeats the check. Without your own
domain nothing changes: the standard address keeps working.
Health checks
Default health checks for hosts or groups; see Agents and hosts.
Autopilot
Rules that let SEK Systems create and run routine plans by itself (only package upgrades and Windows updates), with guardrails: two admins approve each rule with their security key, a maintenance window, health checks and rollback, a canary host first, and a pause at the first failure. New rule and Simulate (shows what a rule would do, without doing it).
Hardening policy
Which benchmarks your environment or a group follows, and the mode per check (monitor, on approval, enforced). See Hardening.
SBOM, VEX & community statistics
Export a software bill of materials (SBOM) and vulnerability statements (VEX) of your environment, and choose whether your environment contributes to the anonymised community statistics (how often comparable updates succeeded). Community statistics only appear when enough independent environments contributed, so no single organisation can be recognised.
Segmentation policy
Not available yet.