NeQter User Manual
Use this manual to investigate logs, monitor hosts, manage compliance work, and produce reports. The updated walkthroughs were checked against appliance version 3.0.1 on October 23, 2026. Menu choices depend on your permissions and the features enabled on your appliance.
New screenshots use example hostnames and IP addresses in place of internal identifiers. Use the names and addresses from your own environment when following the steps.
Table of contents
Start here
- Open the NeQter address provided by your administrator. Read and acknowledge the access notice, then sign in with your account.
- Open Menu at the upper left. Expand a tool category and choose a page. Use the dock control at the bottom of the menu to keep navigation visible while you work.
- Start with Discover’s first search to confirm that you can find collected data. Select a source, choose a time range, and check the results before adding a query.
- Open Hosts > Inventory to check a device’s last-seen information, inventory, and monitoring status.
- Choose a task below when you are ready to save an investigation, configure monitoring, or produce a report.
The current navigation labels the compliance workspace Comply. Its instructions are in the Compliance chapter. Logs > Settings manages enabled indices and dashboard sets; the separate Settings category contains appliance configuration such as inputs, backups, mail, and users.
Follow a complete workflow
Investigate an event and notify your team
- In Discover, choose the relevant source and time range. Add a query or field filters, expand a matching event, and check that the results describe the condition you want to monitor.
- Save the Discover search with a descriptive title. Use Save in the top toolbar; Save current query in the query bar is a different feature.
- Open Events > Monitoring > Create monitor. Select the saved search, then choose the severity, time window, monitor type, and threshold. Review Advanced for the evaluation schedule and repeated-event behavior, then save.
- After the monitor runs, open its details. Check recent results and errors. If it generated an event, inspect that event and its supporting records.
- To send notifications, create an alert rule that matches the relevant event codes or severity and specifies an email or webhook destination. Email delivery also requires Mail settings.
A saved search defines the logs to evaluate, a monitor creates events when its condition is met, and an alert rule delivers notifications about matching events. Review all three when an expected notification is missing.
Turn a saved search into a recurring report
- Prepare a saved Discover search, including the fields you want in its table.
- Open Reports > Run. Choose Custom report for matching log records, or Unique value report for counts grouped by a field such as
host.name. - Select the saved search, configure the report options, and set the historical lookback. Run the report once and review the stored output in Past reports.
- When the output is correct, create a schedule. Review the recurrence, run time, time zone, lookback, and recipients.
- After the first scheduled run, return to Past reports and confirm that the report was generated with the expected content.
The report’s lookback controls which records it includes; the schedule controls when it runs. A saved search does not preserve a fixed copy of the matching records.
Review host software against a baseline
- Find the host and confirm that its inventory is recent.
- Review installed software, then create a baseline policy or start from a representative host.
- Assign the saved baseline to the intended host or group.
- Review Host alignment and investigate missing, unexpected, or mismatched software before changing the policy or adding an exception.
Main categories
| Category | Use it for | Subcategories covered |
|---|---|---|
| System Specifications | Understand supported appliance sizing and deployment expectations. | VM resources, storage, network readiness, backups, maintenance planning. |
| Discover | Search raw events and validate the data behind alerts, dashboards, and reports. | Data views, DQL and Lucene search, filters, fields, row inspection, saved searches, export, sharing. |
| Dashboards | Review visual summaries of logs, hosts, integrations, vulnerabilities, and appliance health. | Enabled indices and dashboard sets, dashboard controls, panel actions, filters, dashboard families, custom visualizations, troubleshooting. |
| Hosts | Manage and investigate assets known to NeQter. | Inventory, host flyout, agents, groups, monitors, hardware, software, baselines, vulnerabilities, unknown devices, host events, exports. |
| Compliance (Comply) | Build and maintain customer SSP documentation. | SSP creation, conversion, access, overview, system identification, environment, requirements, artifacts, POA&M tasks, revisions, exports, organizations, help. |
| Events | Review operational activity and configure alerts. | Monitoring, events, alerts, system events. |
| Reports | Generate reports, review completed output, and maintain recurring schedules. | Past reports, report generation, schedules, report types, reporting safety. |
| Vulnerability Scanner | Configure vulnerability scans and investigate findings. | Dashboard, tasks, reports, results, vulnerabilities, notes, overrides, hosts, SecInfo, targets, port lists, credentials, scan configs, schedules, alerts, tags, feed status, advanced scanner interface. |
| NeQter Settings | Configure appliance-wide behavior. | Backups, certificates, dashboard generation, inputs, license, log tuner, mail, network, support, time, updates, users, LDAP, MFA, system power controls. |
Common page layout
Most NeQter pages follow the same pattern:
- Use the left navigation to open the tool area.
- Confirm the page title and selected subpage.
- Set the time range when the page is time-based.
- Use search and filters to narrow the view.
- Open rows, charts, or flyouts for details.
- Export, save, or act only after confirming the selected scope.
Common controls and buttons
| Control or button | What it does | Customer guidance |
|---|---|---|
| Search or query bar | Filters the current page by a query string or fielded syntax. | Use exact field names when available. In Discover and Dashboards, DQL is the default structured query language. |
| Add filter | Adds a visible field/operator/value condition. | Prefer filters for repeatable investigations because they remain visible above the results. |
| Time picker | Limits the data to a relative or absolute time range. | Use absolute ranges for tickets, reports, or investigations that must be reproduced later. |
| Refresh | Re-runs the current page using the selected time range, query, filters, and fields. | Refresh after changing a time range, query, saved object, input, or scanner state. |
| Create, Add, or New | Starts a new object or draft. Some actions, such as Add host, create a record immediately. | Follow the page-specific steps and use descriptive names that explain owner, purpose, and scope. |
| Edit or pencil | Opens the selected item for changes. | Review dependent objects before saving. One edited group, alert, dashboard, or scan object can affect multiple users. |
| Save | Commits the current form or object. | Confirm the scope and required fields before saving. Some changes may start services or affect ingestion. |
| Save as, when offered | Creates a separate copy instead of overwriting the current object. | Use it for an editable saved search or custom object. For managed dashboards, create a custom dashboard and add the panels you need. |
| Cancel or close | Closes the form or flyout and discards changes that have not been saved or applied. | Changes already applied by a separate Save, Add, assignment, or Delete action remain in effect. |
| Delete or trash | Removes the selected object. | Destructive actions usually require admin permission and may require confirmation. Export or back up first when records must be retained. |
| Enable or disable | Turns a service, rule, dashboard, schedule, alert, or account on or off. | Disable noisy or broken automation while repairing it, then test before re-enabling. |
| Start, stop, or resume | Controls long-running work such as vulnerability scans. | Do not start duplicate work just because a task is slow. Check status first. |
| Test | Sends a test request, mail message, integration check, or connection check. | Always test mail, cloud inputs, storage, and credentials before relying on automation. |
| Upload | Imports a file such as an offline update, certificate, backup archive, artifact, or key. | Verify file type, source, and sensitivity before uploading. |
| Download or export | Writes selected data to a file. | Exports can contain sensitive host, user, log, vulnerability, or compliance information. |
| Expand row or open details | Shows the flyout or detailed view for a row. | Use details before editing so you understand source, history, and related records. |
| Preview | Shows a generated report before download when the format supports preview. | Check time range, included sections, and sensitive data before distribution. |
| Documentation or help | Opens related help content. | Use it for page-specific guidance, especially for integrations and search syntax. |
Permissions
NeQter uses tool-level permissions. A user can have one level for Hosts and a different level for Events, Reports, Compliance, Discover, Dashboards, Vulnerabilities, or Settings.
| Permission level | Typical capability |
|---|---|
| Read only | View, search, filter, inspect, preview, and export data allowed by the account. |
| Read/write | Create and update records, configuration, reports, alerts, or saved objects for the allowed tool. |
| Admin | Perform read/write actions plus destructive or high-impact actions such as deletion. |
| Global administrator | Manage appliance-wide settings, users, updates, system actions, and tools that require global access. |
Ask a global administrator to review your account if a required page or action is unavailable.
Safe operation guidelines
- Confirm the selected organization, time range, host, scan target, report type, or SSP before taking action.
- Use small test scopes before applying changes to a group, scan, alert, dashboard, or input broadly.
- Export or back up important settings before deleting, restoring, upgrading, or replacing configuration.
- Treat all exported logs, host inventories, vulnerability reports, SSPs, artifacts, API keys, passwords, and private keys as sensitive.
- Do not send passwords, API secrets, private keys, or unredacted tokens in support tickets.
- Use Settings -> Support when you need help, and include the page name, timestamp, appliance version, expected result, actual result, and visible error text.