First steps in the dashboard

Once the agent has checked in, the server is protected with safe defaults. These are the first things worth doing.

Before you use AutoMode or approve fixes: turn on two-factor authentication. Approving or rejecting what AutoMode asks, and applying a risky fix yourself, need an owner or admin of the organization signed in with two-factor authentication. Without it nobody can approve: the requests wait on Approvals and expire after 24 hours. While an owner or admin has no 2FA, the security score of every server also loses 5 points. Turn it on under Settings › Security: it takes a minute.

Look at the overview#

Overview opens with the state of the organization in one line, then the servers online, critical events in the last 24 hours, active bans and the security score. Needs attention lists what to look at first: pending approvals, critical incidents, the top fixes of the security score, servers offline or running an outdated agent. The tour of the console opens by itself once, after the first server comes online.

Add your own addresses to the whitelist#

Under Settings › Network, the IP whitelist takes single addresses or CIDR ranges with a label. Whitelisted addresses are never banned by any server of the organization, whatever they trigger. The agent also never bans private and reserved addresses, the server's own addresses and the dashboard's address. See Web firewall and SSH and brute force.

Set up alerts#

Under Settings › Alerts, add an email address. Email is included in every plan; Slack, Discord, Telegram and webhooks are part of Basic and higher. New channels alert on critical events by default. See Alerts.

Turn on two-factor authentication#

Under Settings › Security, Turn on 2FA with an authenticator app. It is optional, but it is required to decide AutoMode approvals and to apply risky fixes yourself, and the security score counts an owner or admin without it. See Two-factor authentication.

Know the defaults#

Out of the box the agent:

• bans SSH and service brute-force attackers: 5 failed attempts within 60 seconds, then a ban of 24 hours, 7 days, 30 days and finally permanent for repeat offenders;
• scores web visitors and bans the ones that reach the ban level;
• inspects DNS traffic and detects port scans;
• does not change web server configuration, block inbound traffic from threat-intelligence lists, ban port scanners or install agent updates by itself until you turn those on.

All of these are under Settings › Agent: see Configuration.

Add the next servers#

Each server needs its own install token. Starter covers one server; Basic and higher have no server limit and bill per server. See Billing and plans.