Settings
The Settings page holds LEA Platform's server-wide configuration. Only admins can change it. Sections:
| Section | What you set |
|---|---|
| Data Retention | How long audit and result data is kept; automatic purge |
| Database Backup | Encrypted backups to local, SSH or S3-compatible storage |
| Webhooks | Notifications to Slack, Postman or any HTTP endpoint |
| Agent Deployment Tokens | Tokens for agent enrollment; Ansible/AWX gateway certificates |
| Single Sign-On (SSO) | OIDC login |
| License Management | View, request and upload the license |
| Compliance | Evidence frameworks, schedules and signing key |
| AI Assistant | Model provider for plain-language questions |
| Severity | Default severity for rules |
| Local User Management | Local accounts |
Click Save Changes to apply; Refresh reloads the saved values. Most changes apply without a restart.
Data Retention
| Setting | Description |
|---|---|
| Audit Retention (Days) | How long audit entries are kept |
| Execution Retention (Days) | How long result history is kept |
| Client Inactive Time (Days) | After this, a host is marked inactive |
| Execution Inactive Time (Days) | After this, a result is marked inactive |
Switches: Automatically purge old audit logs and Automatically purge old executions. Purges only remove data already covered by a successful backup.
Database Backup
Backups run daily to every enabled target and are encrypted (AES-256). Targets, each with its own retention in days:
- Local (on the LEA server)
- SSH (scp) to another host
- Amazon S3 / S3-compatible storage (bucket, region, prefix, endpoint)
The section shows the time of the last successful backup.
Webhooks
LEA sends a webhook when a host's compliance state changes. Deliveries are logged in Audit → Webhook Audit.
| Field | Description |
|---|---|
| Name | e.g. "Network access control" |
| Webhook URL | The receiving endpoint |
| Key / Password | Credentials for the endpoint; the password is never shown again |
| Type | Slack, Postman or Generic |
| Groups | Which host groups trigger this webhook |
| SSL Verify | Check the receiver's TLS certificate |
Leave the password empty to keep the stored value. Webhooks can be edited, cloned and deleted.
Agent Deployment Tokens
Create, rotate and revoke the tokens agents use to enroll, and issue or revoke gateway certificates for Ansible/AWX. Details in Agent enrollment.
Single Sign-On (SSO)
LEA supports OIDC single sign-on with Keycloak or Microsoft Entra ID.
| Field | Description |
|---|---|
| Provider | SSO provider |
| Provider URL / Tenant URL | Base URL of the identity provider |
| Backend Provider URL | Provider URL as reached from the LEA server (blank = same) |
| Realm / Tenant ID | Realm (Keycloak) or tenant (Entra ID) |
| Client ID | OIDC client identifier |
| SSO Display Name | Label of the SSO login button (empty = SSO login off) |
| Redirect URI | Leave empty for the default |
License Management
Shows status, license ID, customer, install date, valid-until date and days remaining, maximum hosts, and licensed features.
- Generate Request: create a license request containing this server's machine fingerprint; copy it or download it as JSON and send it to GSR.
- Upload License: paste or upload the license file you receive.
The license is an offline file bound to the server; no call home is needed. The maximum number of hosts is enforced when agents register.
Compliance
Turn evidence frameworks on or off and set snapshot interval, report interval, report format (JSON, PDF or both) and host group scope. Rotate or set the HMAC signing key. See Compliance evidence & reports.
AI Assistant
Choose the model behind the assistant. By default it runs on a local model through Ollama, so questions and data stay on your servers. You can point it at an external provider instead. The assistant turns questions into read-only (SELECT-only) SQL and shows tables and charts.
Severity
Set the default severity used for rules.
Local User Management
LEA has two roles: admin (full access) and read (read-only). Users can log in with a local account or through SSO.
Prefer SSO for people. Keep local accounts for service/API access, break-glass access and first-time SSO setup.
Good practice
- Use SSO for interactive users.
- Set retention to match your compliance policy; keep backups enabled so purges are safe.
- Keep SSL Verify on for production webhooks, and rotate webhook credentials.
- Watch the license end date.
- Test SSO changes on a non-production LEA server first.
Try LEA Platform on your own servers:
Start a free POCTry it on your own servers.
30 days, up to 25 endpoints, every feature. We help you install it and agree on success criteria first.