Admin & Settings

Administration lives in the Settings area, reached from the gear icon at the bottom of the sidebar (/admin/settings). This page is a reference to every settings screen and what it does.

The settings hub is titled Tenant Settings ("Configure your tenant's platform settings") and shows a grid of cards. Each card shows whether it's Configured or Not Configured. Some open a dialog in place; others take you to a dedicated page. Some cards are only visible if you have the right permission.

The settings hub at a glance

Model Providers

Configure the AI that powers triage, investigations and "Ask CloudPeek." You add one or more providers with credentials and choose default models (chat, embedding, and the model used by background workers). Each tenant can pick its own provider and model. Without this configured, AI features won't run (you'll see prompts to set up a provider). See the Quickstart.

Tool Management

The full tool/integration experience, documented in its own page: Tools & Integrations. Reach it from the Tool Management card or /tools.

Runtime Configuration

/admin/settings/runtime-config: per-tenant tuning knobs for the AI runtime, grouped into sections. The most relevant for most teams:

• Agent runtime: maximum iterations, context size, the number of concurrent sub-agents, and the plan approval timeout and tool approval timeout that govern Human-in-the-Loop waits.
• Retry & backoff: how the agent retries transient failures.
• Context compaction: how long conversations are condensed to fit the model.
• Tool results / Storage clients: handling of tool output and storage.
• Client integrations: Slack identifiers/tokens used by integrations.
• HTTP requests: whether the agent may make outbound HTTP requests (off by default; also requires a specific permission).

Each field has a label, description and sensible default, adjust carefully.

User Management

/admin/users (the User Management card; needs the user:read permission). Here you:

• See all users in a table (Email, Name, Role, Created).
• Create User: add a user with email, password, name, and roles assigned per tenant. A permission preset dropdown can bulk-set roles. Presets include Global Admin, Tenant Admin, Senior Analyst, Analyst and Read-only.
• Change Password or Delete User for an existing user (you can't delete your own account; users from another tenant are read-only and marked Cross-tenant).

On a self-hosted instance you can also add a user from the host itself with ./cpk adduser, which is handy for the first account after the admin. See the cpk Command Reference.

Tenant Management

/admin/tenants (needs tenant create/update permission). Create new tenants and edit tenant metadata.

Audit Logs

/admin/audit-logs: the complete, attributed record of activity. Two tabs:

• Audit Logs: who did what: Timestamp, User, Action, Resource, Status, IP Address. Filter by success/failure, event type, resource type, user and date range.
• Application Logs: system logs: Level (Critical/Error/Warning/Info/Debug), logger, message, outcome, source.

You can search and export as CSV or JSON. This is your evidence trail for compliance and investigations into the platform itself.

Analytics

/admin/analytics (also linked from the sidebar). Historical dashboards across four tabs:

• Performance: response and triage performance over time.
• Agents: AI agent activity.
• FINOPS: AI usage and cost.
• Audit: audit analytics.

Choose a time range (last 24 hours, 7/30/90 days, or last year). Use these for reporting and trend-spotting, versus the live Dashboard for the current picture.

Alert Silencing

/admin/settings/silencing: "Manage silencing rules to suppress investigation for known false positives and triage cache cooldowns." Create rules that stop specific tool/type/name/host/user combinations from being triaged (so known-benign noise doesn't generate work), and manage the triage cooldown cache that prevents the same alert being re-investigated repeatedly.

Hunt Rules

/admin/settings/hunt-rules: "the detection rules that surface lead bundles across your incident stream." Activate or disable the rules that power Threat Hunting.

Client Integrations

/admin/settings/client-integrations: manage Slack and webhook integrations (notification sinks) so CloudPeek can post to your channels or call your endpoints.

Seed Sync

/admin/settings/seed-sync: upload seed manifests (JSON) to bulk-load or update configuration. Drop files in, Upload & Preview to see a diff (Entity Type / Identity / Action / Changed Fields), then Apply Changes. Deletions are shown for information only and aren't executed automatically.

OpenTelemetry

The OpenTelemetry card configures exporting CloudPeek's logs to an OTLP collector, so you can feed platform telemetry into your own observability stack.

Permissions and roles

Access to these screens is governed by roles made up of resource:action permissions (for example user:read, incident:write, *:* for full admin). Roles are assigned per tenant, and the presets in User Management are a quick way to grant a sensible bundle. The same permission model governs the API.

Related

• Human-in-the-Loop: the approval timeouts set in Runtime Configuration.
• Tools & Integrations: the Tool Management card in depth.
• Threat Hunting: what Hunt Rules drive.