Settings

Settings controls the NeQter appliance: backups and retention, HTTPS certificates, incoming data, outbound email, networking, time, software updates, and user access. Open Settings in the left navigation, then choose a page from its submenu or the tabs across the top.

Click any screenshot to open it at full size.

Page map

Backups

Backups separates live searchable data from compressed files. Searchable logs appear in Discover and dashboards. Log archives are compressed backups that must be restored before their logs can be searched again. Settings backups contain NeQter configuration and supporting settings. Past reports are generated report files and have their own retention setting.

Use the six tabs to work with each category. The summary cards on Logs & log archives show the current searchable log period, archive period, and whether new backups are password protected. The reference appliance shows 14 days, 90 days, and protection off; these are its saved values.

Backup page actions and recovery key

Help opens the built-in explanation of backup types and operation. Run backups starts a backup operation immediately using the saved configuration. It does not open a setup wizard. The built-in help describes the automatic daily backup run as 1 a.m.; use this button when a current backup is needed between automatic runs.

While a backup, restore, or transfer is active, NeQter displays its status and locks conflicting actions. A vulnerability scan can also prevent starting a backup or restore. Wait for the displayed operation to finish before changing backup settings or starting another operation.

Export recovery key downloads the appliance recovery key. This key is used to unlock the NeQter drive outside normal startup. Store it in the organization’s password vault or equivalent recovery location. It is separate from both the password for protected backup files and the password for a remote storage account.

Searchable log retention and archives

On Logs & log archives, configure the following fields and click Save settings in this section to apply them:

Use periods from 1 to 1,095 days. When archives are enabled, their retention period must be at least as long as the main searchable log period. Set a period that fits both your retention requirements and available storage; a longer archive period does not make those archived logs searchable without a restore.

To add an override:

1. In Log group, select an available pattern or type a pattern and accept it in the selector. An asterisk matches a group, for example neqter-events-*.
2. Enter Retention period (days) between 1 and 1,095. Add an optional Description explaining the exception.
3. Click Add override. The row appears with its pattern, days, description, and Active badge.
4. Review the row, then click Save settings to persist the complete log configuration.

The row’s trash icon removes that override from the draft list. Save afterward to apply the removal. Add override and the row trash icon do not save the configuration by themselves. The example below is an unsaved 30-day override.

Log archive table

The table below the settings lists archive files, their compressed Size, Protection status, and row Actions. Search narrows the table as you type. Click a sortable column heading to change the order; use the page controls and Rows per page to inspect more files.

Open a row’s three-dot menu for Export, Restore, and Delete:

To restore logs, choose the archive or archives, enter the backup password if requested, and select the required log indices in Restore from log archive. Its search box narrows the index list, and its checkboxes choose what will be imported. Click Restore selected when ready. NeQter checks disk space before starting and may ask for an additional confirmation when space is low. Cancel leaves the selection without starting a restore.

The restore status shows each index as pending, importing, successful, or failed. Stop interrupts an active restore; data already imported may be incomplete. After the restore finishes, Next leads to the rotation-exception step so restored old indices can remain searchable until a chosen removal date. Review any errors before using the restored data.

This interface restores NeQter log archives and settings backups created by version 3 or newer. An unsupported archive produces a compatibility notice instead of a usable restore selection.

Upload a log archive

Click Upload above the log archive table. Select or drag in an original NeQter log archive, such as a file named YYYYMMDD-vslog.tar, then click the flyout’s Upload button. Keep the original archive filename and format. Wait for the upload to finish, locate the file in the table, and use Restore if you need its logs in search.

The flyout’s close link or X closes the chooser. Selecting a local file alone does not upload it.

Rotation exceptions

An index rotation exception temporarily protects a particular live log index from ordinary retention cleanup. This is especially useful for restored logs that are already older than the normal retention period. A retention override applies to a log pattern; a rotation exception applies to a selected index until its removal date.

The table shows Index, Size, Document count, and Removal date. Search and sorting help locate an existing exception. The example has no exceptions.

1. Click Add index to open Add indices to exceptions.
2. Use search and On exception list / Not on exception list to locate the indices. Select the rows you want to protect.
3. Click Add N indices, choose the removal date, and Save in the date dialog. The date must be in the future.
4. Verify the indices and dates in the exceptions table.

Selecting an index that already has an exception updates its removal date. The selector below has no available rows, so Add 0 indices is disabled. Close or X leaves the selector.

Use an existing exception’s Edit pencil to change its removal date, or its Remove trash icon to remove the exception. Selecting several rows reveals Edit N indices and Remove N indices for a group. The add selector also has a row Add icon for one index. Removing exceptions opens a confirmation; Yes, delete the exceptions removes the protection. The affected logs can then be deleted by normal cleanup. Removing the exception is not a request to export or back up those logs.

Past report retention

Open the Reports tab to control how long generated files remain on Past reports.

Set Rotate past reports to enabled for automatic cleanup and enter Report retention period (days) from 1 to 3,650. Click Save settings to apply the switch and period. Disabling rotation and saving keeps past reports until they are deleted manually. This setting controls existing report files; report schedules control when new reports are generated.

Settings backups

Open Settings backups. Create settings backups enables a daily copy of NeQter settings and supporting configuration. Enter Settings backup retention period (days) from 1 to 1,095, then click Save settings. The switch and period are saved together.

The NeQter settings backups table shows the filename, compressed size, and protection status. Search, sortable headings, and pagination work within this table.

The three-dot menu contains Export, Restore, and Delete. Export downloads the selected settings backup. Restore reads the backup’s contents and opens the restore choices if compatible. Delete opens a confirmation; Yes, delete it removes that stored file, while No, don’t delete it cancels.

For a protected file, enter its backup password first. In a compatible restore, review the available configuration areas. NeQter settings and required saved-search/index-pattern content may be fixed selections; optional compatible areas can be selected separately. The final Yes, restore these settings applies the selected backup contents to the appliance. Read that selection as replacement configuration, not as a preview of the existing settings.

The reference file produces the Version 3 compatibility notice below. Ok closes this notice; it does not restore the file.

To import a saved settings backup, click Upload above this table, choose its original .tar.gz file, and click Upload in the flyout. The file must be a valid NeQter settings backup. Once uploaded, use its Restore action to apply it. close and X cancel the chooser.

Password protection

Open Protection to require a password when restoring newly created backup files.

1. Enable Password protect new backups.
2. Enter a Password of at least eight characters and enter the same value in Confirm password.
3. Store that password with your recovery information, then click Save settings.

This protects both new log archives and new settings backups after the setting is saved. Existing files keep their existing protection. If protection already has a saved password, the page explains that leaving both password fields blank keeps it; fill both fields only when replacing it. Disabling protection and saving affects future backups.

The screenshot shows an unsaved enabled draft with matching fictional passwords masked by the application. These example values were discarded without changing backup protection.

Backup storage

Open Backup storage and select Local or Remote file share (SMB/Samba). Local keeps files on the NeQter appliance. The Save settings button applies the selected location.

For a remote share, fill these fields:

Click Save settings to apply the share and connection settings. NeQter reports mount or permission failures if the location cannot be used. After saving remote storage, the Move existing local backups prompt offers Move backups or Don’t transfer. Moving starts a transfer of the existing local files; declining leaves them local.

If remote storage is already saved and local files remain, Move local backups starts that transfer directly. Backup settings and actions are locked while files move, and progress shows completed files and the current filename. When remote storage is selected, the backup tables show that storage location; local files left behind are not included in the remote listing.

Certificates

The SSL Certificate page manages the HTTPS certificate presented by the appliance. The visible subject fields describe the currently installed certificate. The top actions and the form’s Generate button have different purposes.

To install an existing certificate, click Import. Paste the PEM certificate into Certificate and its corresponding PEM key into Private key, or use the separate file-picker buttons to read each from a local file. Keep the PEM BEGIN/END lines intact. Both values are required.

Click the flyout’s Import to install the pair. The application reloads after applying the certificate. Cancel or X closes the draft. Merely selecting a certificate or key file reads it into the form; the final Import button performs the upload and installation.

Dashboards

Settings → Dashboards and Logs → Settings open the same Manage dashboards controls. Use this page to choose the enabled indices and supplied dashboards.

1. Search for a source or dashboard title.
2. Turn on Enable index for the source when available, then select the dashboards you need.
3. Select Apply changes to save the selection.

For the current screenshots, index behavior, and individual dashboard choices, see Choose enabled indices and dashboards. To open a visualization after enabling it, use Logs → Dashboards.

Inputs

Use Settings → Inputs to configure incoming syslog and supported cloud API collectors. The left menu separates Syslog, Cisco Meraki, Cisco Secure Endpoint, Google Workspace, and Microsoft Office 365. API collectors retrieve logs periodically; receiving syslog requires the sending device to forward its logs to the appliance.

Syslog inputs

Create a syslog input for each sending address and choose the parser that matches the device. The page explains that logs without a matching configured input are dropped. Use Other when the sending product has no supported parser.

Add or edit a syslog input

Select Add input, enter a Label and IP address, and choose the Manufacturer matching the sender. Configure the remaining options and select Save. Cancel or the form’s X closes without saving.

Other ingests a source without a supported parser into a custom index. Its form omits DNS resolution. Existing Other inputs cannot be edited through the row’s Edit action; the interface disables that action for them.

For a supported input, use the row’s Edit action to change the saved configuration. Delete opens a confirmation naming the input; confirm only when you intend to remove that input configuration.

Inspect input activity and storage

To check whether a source is sending logs:

1. Open Settings → Inputs → Syslog.
2. Search for the input’s label or address and press Enter.
3. Read Status, then select the arrow at the left of the row (Show details).
4. Check Last seen, Logs in last 24h, and Indices with logs. Use Refresh stats to request updated values.
5. If the input is Not receiving, verify that the source device is forwarding logs to the appliance and that its sending address matches the configured input. Recheck after it sends another event. Use Discover to inspect the collected event content.

Select the row arrow again (Hide details) to collapse the panel.

The details include Logs ingested, Estimated storage used, Share of logs, Logs in last 24h, Indices with logs, First seen, and Last seen. Storage is an estimate. Read the chart and individual statistic labels separately: the panel contains both activity over a time range and cumulative information about the input.

Detect an input that stops sending

Open Down detection, set Enable down detection, and choose Wait before marking an input down. Available waits are 5 minutes, 10 minutes, 30 minutes, 1 hour, 3 hours, 6 hours, 12 hours, and 1 day. Select Save to apply the settings or Cancel to leave them unchanged.

Down detection creates events. For email or webhook delivery, configure an alert rule for event codes 1020 or 1021 in Events → Alerts.

Cisco Meraki API collection

The Cisco Meraki page configures collection from the Cisco Meraki Dashboard API. This is separate from selecting Cisco Meraki as a syslog manufacturer.

1. Open Setup Guide, or follow our guide in the form, for the application’s instructions on enabling Dashboard API access and obtaining an API key.
2. Choose Meraki environment: Commercial or Government cloud.
3. Enter the Meraki API key from the appropriate Meraki environment.
4. Select Save settings and enable. The application validates and saves the configuration, then starts collection when the setup succeeds.

The Service enabled switch at the top disables an active service immediately when clicked. When the service is disabled, its switch cannot be used to enable it; complete the setup form instead. The environment and API-key fields are unavailable while the service is enabled. To change those credentials, disable the service and complete setup with the replacement values.

Cisco Secure Endpoint API collection

Use Cisco Secure Endpoint for the Cisco Secure Endpoint API v1 collector. Open Setup Guide or the in-page guide link for the credential setup instructions, then enter the Client ID and API key generated in the Secure Endpoint console.

Select Save settings and enable to submit the credentials and enable collection. The page’s Toggle Secure Endpoint service control disables an enabled collector. When disabled, use the setup fields and save button to enable it. Guide links open instructions; the Secure Endpoint console link opens the provider’s console.

Google Workspace collection

Google Workspace uses an authorization grant from an administrator of the Workspace domain. The configured page lets you choose which audit event types to retrieve.

For a new or disabled collector, select at least one event type, then choose Request auth URL. Complete Google sign-in and consent using a domain administrator account. If the sign-in window does not open, use the continuation link displayed in the form. Paste the returned code under Enter authorization code, then select Authorize and enable. That final action saves the options, completes authorization, and enables collection.

If the form reports Google did not return a refresh token, use Open Google sign-in again. The recovery notice explains when to remove the existing NeQter authorization in the Google account and authorize again. A refresh token is required before collection can be enabled.

Audit records are retrieved periodically. An absence of a newly performed action does not by itself mean collection has failed; check the collection options and the provider’s availability delay.

Microsoft Office 365 collection

Office 365 supports multiple configured tenants. The table identifies each tenant, its plan, whether collection is enabled, and which workloads are selected. Check and cross icons in the workload columns summarize the saved choices. The screenshot below shows a new-tenant draft with fictional identity values; it does not represent an enabled integration.

To add a tenant, select Add Office 365 tenant and work through the form. Register the application and grant the required permissions in the correct Microsoft environment before submitting the configuration.

The setup guides explain the application registration, secret, and permission steps. Select a tab to read that portion of the procedure. The in-form follow our guide links open the corresponding guidance.

In Choose which log types to retrieve, enable at least one workload. Microsoft Entra ID covers directory user and policy events; Data Loss Prevention covers DLP policy events and requires its associated permission; Exchange covers Exchange activity; General covers activity outside the other categories; SharePoint covers SharePoint activity. The Exchange description includes a link about mailbox auditing.

Select Save settings and enable to validate the supplied access and enable the tenant. If validation fails, review the returned message and correct the credentials, permissions, plan, or selected workloads. Cancel or X closes the draft without saving it.

For an existing tenant, Edit input allows changes to the display name, selected workloads, and client secret. Tenant ID, Client ID, and subscription plan are read-only in this form. Leave the client-secret field empty to retain the saved secret; enter a replacement only when updating it. Select Save to apply the changes.

License

Product License shows the installed license’s Customer, Customer ID, Product type, Date active, Date expires, and Status. Use the dates and status to verify that the appliance has the intended active license.

Click Upload new license when you have a replacement license file supplied for this appliance. Select or drag that license file into Upload license, then click Upload to install it and refresh the displayed license details. The expected supplied file is license.tar.gz.enc; keep its original format. Cancel or X closes the dialog without uploading.

This upload supports appliances that are offline. Complete a needed renewal before the displayed expiration date; the dialog directs users with an expired license to support.

Log tuner

Settings → Log tuner creates cleanup rules for noisy logs. When every condition in a rule matches, the tool keeps the event’s time and original message and removes its extra parsed fields. Consider whether searches, dashboards, or monitors need those parsed fields before applying a rule.

Build a filter

1. Select Add filter.
2. Choose the Index pattern for the log source.
3. Search or sort the field table to find the field containing the repeated value. Name identifies the field; Type describes its data type. Use Rows per page and the page controls for longer lists.
4. Select the field’s Add filter plus button to open the condition editor.

The Values found in the last 24 hours table helps you inspect real values for the selected condition. It uses a broad search for that field, so the listed counts are not a preview of all the conditions combined. Count shows how often each value appears; Matches shows whether the currently selected condition matches that value. Search and pagination narrow the displayed value list. Use value copies a row’s value into the selected condition as an exact match.

Add conditions when a single field would identify too many events. For example, an exact action value can be combined with a pattern for a particular group of device names. The following illustration is an unsaved example: it requires both the action allowed and an observer.name beginning with branch-.

Enter a regex pattern without surrounding slash characters. For example, ^branch-.* matches a value beginning with branch-; error|failed matches either alternative. Regex matching is case-sensitive. The help panel explains anchors, alternatives, numeric character classes, and escaped dots.

Change or remove a saved filter

The Current filters table displays the index pattern and the rule’s conditions, joined by AND. Use the pencil Edit action to reopen a filter and Save to apply changes. Use Delete to open Delete log tuner filter?, then Delete filter to remove the rule and regenerate the cleanup rules. Cancel closes the confirmation. Help opens the same Log tuner regex guidance available from the editor.

Mail

Mail defines the sender information and delivery service used for outgoing notifications and alerts. The page contains two separately saved areas: the upper Mail settings and lower Outgoing mail settings.

Sender address and subject prefix

Enter From address as the sender email address and optionally enter Subject prefix, which is added to outgoing email subjects. Click the upper Save settings to save these values. A relay or authentication service can require the From address to match the sending account, or can override it.

The lower tabs select Gmail, Microsoft Graph API, or SMTP relay server for configuration. Switching a tab only changes the form being displayed. Use that provider’s save, upload, or connection action to configure delivery.

Reset configuration immediately clears the configured outgoing delivery provider. It preserves the upper From address and Subject prefix. It does not open a confirmation or simply clear an unsaved form.

SMTP relay server

Select SMTP relay server when NeQter should send mail through an SMTP host.

1. Choose Type. A named service fills the host, port, and TLS choice; choose Custom to enter those connection details yourself.
2. Review Host, Port, and Use TLS.
3. Enter Username and Password when the service requires authenticated SMTP. The named Gmail, Outlook, and Yahoo presets require credentials; custom authentication is optional when the relay permits it.
4. Click the lower Save settings to apply SMTP delivery.

The presets in this interface use Gmail smtp.gmail.com:587, Office 365 smtp.office365.com:587, Outlook smtp-mail.outlook.com:587, and Yahoo smtp.mail.yahoo.com:465. The first three leave the direct-TLS box off; Yahoo turns it on. Treat these as the form’s presets and confirm the sending account is configured to use the chosen service.

Microsoft Graph API

Select Microsoft Graph API to send NeQter notifications through an Exchange Online mailbox. The application registration, client secret, and Microsoft permissions follow the same setup used in NeQter V2. Complete the Microsoft setup below, then save the sender and delivery settings in NeQter.

Register the mail application

1. Sign in to the Azure portal or Microsoft Entra admin center for the tenant that owns the sender mailbox. Enterprise/business and GCC use the worldwide cloud; use the Azure Government portal for GCC High.
2. Search for App registrations, open it, and select New registration.
3. Enter a recognizable name, such as NeQter Mail.
4. Select Accounts in this organizational directory only for the supported account type, then select Register. This application sends mail without an interactive user sign-in, so an OAuth redirect URI is not needed for this setup.

On the application’s Overview page, record both identifiers:

Use the application and directory identifiers from this registration. The application’s Object ID is a different value. See Microsoft’s application registration guide.

Create a client secret

1. In the registered application, open Certificates & secrets > Client secrets.
2. Select New client secret.
3. Enter a description and choose an expiration permitted by your organization’s policy.
4. Select Add.
5. Copy the new secret’s Value into secure storage immediately. NeQter requires this value in Client secret; the separate Secret ID is not the credential. The value cannot be retrieved again after leaving the creation view.
6. Set a reminder to create a replacement secret and update NeQter before the current secret expires.

The screenshot shows the available expiration choices when it was captured. Follow your organization’s current credential policy when choosing a lifetime. See Microsoft’s client-secret configuration instructions.

Add sending permission and grant consent

1. Open the application’s API permissions page and select Add a permission.
2. Choose Microsoft Graph > Application permissions.
3. Find Mail.Send, select it, and choose Add permissions.
4. Have an administrator authorized to grant Microsoft Graph application permissions select Grant admin consent for your organization, then confirm the request.
5. Verify that Mail.Send is listed with type Application and that admin consent is granted.

This connection uses application credentials to send mail. Microsoft’s sendMail permission requirements specify application Mail.Send for this flow. The delegated SMTP.Send permission shown in the V2 screenshot belongs to a separate SMTP AUTH OAuth flow; it is not required for Microsoft Graph sending.

If the consent action is unavailable, ask your tenant administrator or Microsoft 365 provider to complete it. Registering an application does not automatically give the person creating it permission to grant tenant-wide Graph application consent. See Grant tenant-wide admin consent.

Save the connection in NeQter

1. Open Settings > Mail. In the upper Mail settings, enter the intended Exchange Online sender mailbox in From address, set an optional Subject prefix, and select the upper Save settings.
2. In Outgoing mail settings, select Microsoft Graph API.
3. Enter the Tenant ID, Client ID, and client-secret Value collected above. Tenant and Client IDs must be GUIDs from the application’s Entra setup.
4. Choose the Subscription plan type that matches the tenant: Enterprise / business plan, GCC government plan, or GCC high government plan.
5. Select the lower Save settings to apply Microsoft Graph delivery.
6. Select Send test email, enter a destination in Deliver To, and select Send. Confirm receipt and the expected sender. See Send a test email.

Use a sender mailbox that exists in the tenant and is allowed by any Exchange application-access restrictions. Have the Exchange administrator confirm the tenant’s supported configuration before using an alias. The subscription selection must match the Microsoft environment; Microsoft’s national-cloud guidance explains the commercial, GCC, and GCC High service differences.

When an existing Graph configuration is loaded, the client and tenant identifiers can be locked while the secret is represented by a placeholder. Use the page’s reset/reconfiguration workflow when changing the application identity, and save the new credentials before testing.

If delivery fails, check that the saved client secret is its Value, that it has not expired, that application Mail.Send has admin consent, and that the sender mailbox and subscription plan match the configured tenant. A queued test confirms that sending was requested; check the destination to confirm delivery.

Gmail

Open Settings > Mail > Gmail to send notifications and alerts through the Gmail API. Choose the connection method that matches the sender mailbox:

Both methods use this send-only scope:

https://www.googleapis.com/auth/gmail.send

The scope permits sending mail without granting mailbox read, search, modify, or delete access. Google classifies it as a sensitive scope; external applications may need verification depending on their audience and publishing status. See Google’s Gmail API scopes.

Google sign-in

Use this method when the sender can sign in to a personal Gmail or Google Workspace account and approve access. NeQter sends from the mailbox that approves the prompt.

Create the Google Cloud project

1. Open the Google Cloud Console.
2. Create or select the project NeQter will use for mail sending.
3. Open APIs & Services > Library.
4. Search for Gmail API and enable it.

Configure Google Auth Platform

If Google Auth Platform is not visible in the menu, find it using the Google Cloud Console search bar.

1. Open Google Auth Platform > Branding and select Get Started if prompted.
2. Complete the application name, support email, and contact information.
3. Open Audience and choose the user type. Internal limits access to your Workspace organization and requires a project associated with that organization. External allows personal Gmail accounts or users outside the organization to connect.
4. For an External application in Testing, add the sender mailbox under Audience > Test users.
5. Open Data Access and add only https://www.googleapis.com/auth/gmail.send for this mail connection.

For an External application left in Testing, Gmail authorization and its refresh token expire after seven days. For ongoing sending, use the appropriate production publishing status and complete any verification Google requires. See OAuth consent configuration and Google’s Testing status requirements.

Create the OAuth client

1. Open Google Auth Platform > Clients and select Create Client.
2. Choose Web application.

3. Add the following exact value under Authorized redirect URIs:

   https://docs.neqterlabs.com/oauth_redirect.html
   

4. Create the client and its client secret.
5. Use Download JSON when the credentials are created. Download and securely store the file at this point; Google does not allow the full client secret to be viewed or downloaded again after creation. See OAuth client management.

The OAuth client JSON contains the Client ID and Client secret. Upload this file to NeQter to continue authentication. It is different from the service-account JSON key used by the other connection method. Google’s Create access credentials guide describes the client setup.

Connect the sender in NeQter

1. Set the sender’s From address in the upper Mail settings and select its Save settings.
2. Under Outgoing mail settings, select Gmail > Google sign-in.
3. Under Google OAuth client JSON, select the downloaded OAuth client JSON file.
4. Select Upload client. NeQter saves the client configuration and opens the Google sign-in prompt automatically.
5. Sign in as the sender mailbox and approve sending access.
6. If prompted, copy the authorization code displayed on the return page into NeQter’s Authorization code field, then select Complete connection.
7. Confirm Connection complete, then send a test email.

If consent is incomplete, Reopen Google sign-in opens the prompt again. The mailbox that authorizes the connection is the mailbox NeQter sends from.

For an existing client, Replace OAuth client JSON opens a replacement file chooser; Cancel leaves the current client in place. Upload client applies the replacement and begins a new connection. Remove OAuth client JSON immediately removes the saved client and connection; there is no second Save step.

Service account

Use this method when a Google Workspace administrator wants NeQter to send from a Workspace mailbox through domain-wide delegation. Personal Gmail accounts cannot use this method.

The service account authenticates the application and impersonates a real Workspace Gmail user; it does not send mail as itself. Keep these two identities separate:

The sender must be a real Workspace user with a Gmail license and Gmail enabled. A group, distribution list, routing address, or alias alone is not a sender mailbox for this setup.

Create the service account

1. In the Google Cloud Console, create or select the project for NeQter mail sending.
2. Open APIs & Services > Library and enable Gmail API if it is not already enabled.
3. Open IAM & Admin > Service Accounts and create a service account for NeQter mail.
4. Open the service account’s details, then Show advanced settings.
5. In the Domain-wide delegation section, copy the service account’s numeric Client ID or OAuth client ID.

Use the numeric client ID when authorizing delegation. The service-account email address is not the client ID.

Authorize the Workspace domain

1. Sign in to the Google Admin Console as a Workspace super administrator.
2. Open Security > Access and data control > API controls.
3. Select Manage Domain Wide Delegation, then Add new.
4. Paste the numeric service-account client ID.
5. Grant only https://www.googleapis.com/auth/gmail.send for this connection.
6. Select Authorize and confirm that the client ID and scope are listed. If your organization uses multi-party approval, another super administrator must approve the request.

Delegation changes usually apply within a few minutes but can take up to 24 hours. See Google’s domain-wide delegation instructions.

Create the JSON key

1. Return to Google Cloud Console > IAM & Admin > Service Accounts.
2. Open the service account and its Keys tab.
3. Select Add key > Create new key.
4. Choose JSON, create the key, and store the downloaded file securely.

The file contains a private key and should be protected as a credential. If key creation is disabled by organization policy, ask the Google Cloud administrator to review the requirement for this connection. See Create and delete service account keys.

Connect the sender in NeQter

1. Set the licensed Workspace sender mailbox, such as alerts@example.com, as the upper From address and select Save settings.
2. Under Outgoing mail settings, select Gmail > Service account.

3. Choose the service-account JSON key file. Use its client_email value for the service-account address if the form asks you to enter that address:

   { "client_email": "neqter-mail@my-project.iam.gserviceaccount.com" }
   

4. Confirm that the sender mailbox is the Workspace user to impersonate, rather than the service-account address.
5. Select Upload key to save the key and service-account delivery configuration, then send a test email.

The active service account is shown after setup. Replace key opens a replacement chooser; Cancel abandons the replacement and Upload key saves it. Remove key immediately removes the stored service-account key.

Service-account troubleshooting

If an administrator’s sender mailbox works but another sender does not, delegation may already be configured correctly. Check the other mailbox before changing the service account.

Confirm that the sender is:

• A real Workspace user in the authorized Workspace domain.
• Licensed for Gmail and enabled for the Gmail service.
• Able to send mail normally.
• The user entered as the sender in NeQter, rather than only an alias, group, or distribution list.

For this NeQter flow, the sender address is also the impersonated user. Alias-only senders may fail. If no sender works, compare the numeric client ID and gmail.send scope in Admin Console with the service account in the uploaded key, and allow time for a new delegation grant to propagate.

Use Send test email after saving changes, then confirm receipt at the destination. Google’s Gmail sending guide provides additional API background.

Send a test email

After saving the sender and delivery configuration, click Send test email. Enter the destination in Deliver To, then click Send. NeQter queues a test using the saved mail configuration; the test does not apply unsaved changes elsewhere on the page. Cancel or X closes the flyout without sending.

Check that the received message has the expected sender and subject prefix. If it does not arrive, check spam handling and the selected provider’s saved connection details. A queued confirmation indicates that the send was requested, not that the recipient has received it.

Network

Network lists interfaces detected by the appliance and provides separate controls for its domain name and each interface. Read the currently selected interface name before editing; the reference appliance has one interface, ens18.

Domain name

Enter the appliance’s domain in Domain name, then click Change domain to apply it. This setting applies to all interfaces. It is separate from an interface’s DNS search suffix. The button is disabled until the domain changes and requires a valid domain name.

Interface configuration

Select an interface tab, edit its fields, then click Apply changes at the bottom. The interface switches and text fields remain drafts until Apply changes. Moving to another interface or Settings page discards unapplied edits.

If a different interface already has a default gateway, remove and apply that gateway before assigning one to this interface. Changing the address used by your browser can move access to the new address; the application provides a redirect prompt. Network changes can take up to a minute to be recognized by surrounding equipment.

Support

Documentation and support provides two links. Customer documentation site opens NeQter’s documentation in a new tab. support.neqterlabs.com opens the support ticket portal. Opening either link does not create a ticket or enable remote support.

When requesting help, include the affected page, what you tried, the time of the problem, the installed version, and the error text or a relevant screenshot. Submit the request in the portal. The separate System support mode control is used when support supplies a code.

Time

Time and NTP settings displays Local time at page load and Universal time at page load. These are readings taken when the page loads, not continuously ticking clocks. Correct time matters because improperly configured time can make logs appear out of order.

To change the appliance time zone, select a Time zone and click Save time zone. This save is separate from the NTP fields. Use the saved time-zone selection when checking configuration; the displayed clock strings are the server’s returned readings.

To configure time synchronization, enter the NTP Address and select Type: Pool or Server. Click Save NTP settings. NeQter attempts to synchronize with that address and saves the configuration. If synchronization fails, the dialog asks whether to save anyway: Save retains the new settings despite the failed synchronization; Cancel restores the prior NTP configuration.

Synchronize system time with NTP immediately requests synchronization using the saved NTP settings. It is an action, not a refresh-only button. A success or failure message reports the result. Changing the fields alone does not change the appliance clock or persist a new time source.

Updates

Updates shows the installed version, whether a newer update is available, and the changelog for the most recently installed update.

Check for and install updates

Check for updates refreshes update availability. It does not install an update. Visit our support portal opens older changelogs in a new tab.

When an update is available, the page shows Update now and scheduling controls. Update now opens Confirm update. The final Update starts installation; Cancel closes the confirmation. During installation NeQter can be inaccessible and may reboot more than once. The Update now control is disabled while a backup or restore is running.

To install later, choose the date and time under Schedule update, then click Schedule update. That button saves the schedule immediately. The scheduled banner displays the planned time and warns that service and log collection can be interrupted. Its Cancel button cancels the scheduled installation immediately. Scheduling and installation controls are conditional, so they are absent from the already-current screenshot.

Check the displayed schedule against the appliance’s intended maintenance window before leaving the page. Wait for an installation to finish rather than restarting or powering off the appliance during it.

Offline updating

Click Offline updating to upload a supplied update package when using the offline workflow. Select or drag an update file into Update uploader, then click Upload. NeQter validates the package and required preceding version. Updates must be installed in order; a package for a later step cannot skip its prerequisite.

After a compatible upload, Would you like to install this update now? offers Begin installation and Cancel. Begin installation starts the update. Cancel dismisses that installation prompt; the package was already uploaded. The initial flyout’s close or X leaves the file chooser without uploading.

Users

Settings → Users manages appliance accounts, per-tool access, LDAP integration, and sign-in policies. A global administrator can use all NeQter tools and administrative settings. A per-tool Admin permission applies to that tool; it does not make the account a global administrator.

Find and inspect accounts

Use Search to find users by first name, last name, or email. Sort using the column headings and use Rows per page or the page arrows for a longer list.

Status shows whether the account is enabled. Type distinguishes local, LDAP, and, when present, centrally managed accounts. Global admin shows appliance-wide administrator access. The remaining permission columns show access to Compliance, Discover & Dashboard, Events, Hosts, and Vulnerability scanner. Open the three-dot menu in Actions for account operations.

Create a local user

Select Create user, then Local user. The other choice is LDAP user when a directory server has been configured. If none exists, No LDAP Server Configured opens the LDAP settings form.

Enter First name, Last name, and Email, then assign the required tool permissions. New local-user forms start with tool access disabled. Use Make this user a global administrator only when the account should administer the appliance. Select Save to create the account, or Close or X to abandon the form.

After a successful creation that returns a temporary password, the application displays a Temporary password dialog with a Copy temporary password button. If mail is configured, NeQter also attempts to email the password to the user. The user must change the temporary password at the next login. Record or deliver the password through your organization’s approved process before closing the dialog.

Choose tool permissions

For an account that is not a global administrator, select the appropriate level for each tool. The choices available in this version are:

Disabled removes access to the tool. Read only allows viewing where that role is available. Read / write permits the tool’s editing operations. Admin provides its administrative operations. Individual tools can also have their own object-level access settings, such as SSP access in Compliance. Selecting global administrator access hides the individual selectors because the account has access across the appliance.

Edit, reset, or delete a user

The interface prevents changing the permissions of, or deleting, the only global administrator. Centrally managed accounts have local Edit and Delete actions disabled. In the following example, the currently signed-in account’s enabled switch is unavailable.

Configure LDAP and import users

Select Edit LDAP settings. Supply the directory connection details, then select Save to validate the connection and save the configuration. Cancel or X leaves without saving.

After configuring the server, choose Create user → LDAP user. Enter the password for the directory account named in the prompt and select Submit to query the directory. The Import LDAP Users table supports searching, OUs and Groups filters, row selection, and page sizes of 25, 50, 100, or 250. Select the users and choose Add user or Add N users to import them. Then edit their appliance accounts to assign the required tool permissions.

LDAP users authenticate through the configured directory. The local password-reset and local password-policy controls do not replace directory password management.

Login message

Choose the Login message tab beneath the user table. Turn on Enable login message, enter the Title and Body, and select Save. The message is shown to unauthenticated users visiting the login page and to users attempting a terminal login. The switch, title, and body are pending edits until saved.

Auto logout

Use Auto logout to end an inactive browser session. Enable the feature, set Set auto logout delay (minutes) using the slider, and select Save. The available delay range is 10–120 minutes. After the inactivity delay, the application displays a warning; if the user does not respond within 60 seconds, it logs them out.

Login lockout

Use Login lockout to temporarily block repeated failed sign-in attempts for local and LDAP users. Set Enable login lockout, choose Failed attempts before lockout from 1–100, and set Lockout time in minutes from 1–1440. Select Save to apply the policy. Locked accounts can try again after the configured interval.

Multi-factor authentication

The Multi-factor authentication tab configures the appliance’s second-step login requirement for local and LDAP users. The current state and available methods appear here.

At least one verification method must remain available while MFA is enabled. Configure Mail before relying on emailed codes. Changes to methods or exceptions while the overall enabled state remains the same are saved by Save without the overall-state confirmation.

Enabling MFA requires the second step at the user’s next login. Disabling it keeps existing user enrollment settings for later use.

Password settings

Password settings applies to local users. Configure expiration, complexity, and password history here, then select Save. Directory users remain subject to their directory’s password policy.

System

Click the chip-shaped System icon in the upper-right header to open the global System menu. It is available outside the Settings pages as well. Support opens the support-code form. Global administrators also see Restart and Shutdown. The X closes the menu.

Support mode

Choose Support, enter the Support code supplied by NeQter support, and click Enable. This submits the code and enables support mode if accepted. Pressing Enter in the code field also submits it. Cancel or X closes the form without enabling the mode.

Use this form when working with support; it does not submit a support ticket, and the ordinary appliance login password is not the support code.

Restart and shutdown

Restart opens Restart NeQter. Shutdown opens Shutdown NeQter. Both confirmations explain that power cycling during a backup, restore, or vulnerability scan can lose or corrupt data, and that full initialization after a power cycle can take up to an hour. Cancel or X closes either confirmation.

Ok is the confirmation control for the selected power operation. On the reference appliance, these confirmations can display a restarting or powering-down message without carrying out the operation. Verify the actual system status; contact support if the appliance remains online.