Signing in

Access to the console is limited to registered operators in your tenant. You sign in from the operator sign-in screen with your operator identity plus either a password or a security key.

Which credential you hold depends on how your account was created. Accounts provisioned with a password can use either method. Accounts created by email invitation (invited operators and CAB members) are passkey-only: there is no password on the account, and the security-key flow is the only way in. See Passkeys.

Every sign-in attempt, successful or not, is written to the audit chain. The sign-in screen says as much, right under the form.

Sign in with a password

1. Enter your operator identity. For example you@westgate. Case does not matter, and surrounding spaces are ignored.
2. Enter your password. Use the eye control in the password field to reveal what you have typed if you need to check it.
3. Select Sign in.

If either field is empty, the screen prompts you for it before anything is sent.

Sign in with a security key

If your browser supports it, a Use security key option appears below the password form. This signs you in with a passkey or hardware security key (WebAuthn) instead of a password.

1. Enter your operator identity first. The console needs to know who you are before it can ask for your key. If you skip this step, it tells you to enter your operator identity to use a security key.
2. Select Use security key. The button reads Waiting for security key… while it waits.
3. Complete the prompt from your device or key.

If you dismiss or cancel the device prompt, the console reports that security key sign-in was cancelled. You can try again, or fall back to your password if your account has one.

Note

The Use security key option only appears when your browser supports security keys. If your account is passkey-only, sign in from a browser that supports them. For the keys registered to your account, see Passkeys.

Failed attempts and lockout

If an identity cannot be signed in for your tenant, the console replaces the form with a card headed Not a registered operator. It confirms the attempt was denied and recorded on the audit chain. Select Try a different identity to start over.

After three failed password attempts, the identity is locked. The card then reads Too many failed attempts, and further sign-ins are refused until the lock is cleared. A security key does not bypass the lock.

Locked out?

A locked identity cannot restore itself, even with the correct credentials. There is no self-service reset. Contact your CAB chair to restore access: the tenant owner clears locks from the operators roster on Settings. See Operators.

How long a session lasts

A sign-in lasts eight hours. The clock is fixed at sign-in. Activity does not extend it.

If your session expires while you are working, the console does not automatically return you to the sign-in screen. Instead, pages start reporting that they cannot load and the live-updates banner appears. Reload the page to get back to the sign-in screen.

Signing out

You can sign out from three places: Sign out in the operator menu in the top bar, the sign-out command in the command palette, or the Sign out button on your profile page. All three open the same confirmation, Sign out of the console, showing your operator identity and tenant.

When you confirm:

• Your session is revoked on the server, and the sign-out is recorded on the audit chain. You will need to authenticate again to return.
• Your working state is cleared. Open investigations, applied filters, and the command bar are discarded.
• Live monitoring continues on the server. Signing out only ends your console session. It does not pause protection, stop heartbeats, or interrupt anything happening on your hosts.

To keep your session, select Cancel or press Escape.