Accounts and admin settings

These pages are available to users with account-management permissions.

Accounts

The Accounts page lists manageable accounts and parent relationships. Accounts are sorted with parent accounts before their descendants. Use Create account to add an account when your organization’s workflow allows it. Enter an account name, an email domain such as company.com, and an optional parent account. Users with a matching email domain can be added automatically when they first sign in. Account names are normalized for URL-compatible use: letters and numbers are retained, separators become hyphens, and the name is limited to 80 characters.

Account settings

From an account’s settings you can review or manage the following controls:

• Parent account — place the account under another manageable account. An account cannot be its own parent or a descendant of itself.
• DEVO identifier — set the account identifier used to match alerts from Devo, the log-ingestion source SIEM+ syncs from for this account, in the form name or name@name.
• Email domain — set the domain used for account membership matching. This field is required.
• Timezone — choose the account time zone used for account dates, alert statistics, schedules, and agent history.
• Whitelist / blacklist — add Whitelist or Blacklist entries for an IP address, URL, hostname, or username.
• Days to sync — set the alert and heartbeat lookback period from 1 to 3,650 days, then reset the sync period.
• Alert retention days — keep alerts for 1 to 40 days. Older alerts are removed by housekeeping.
• Users — add a user, change their role, enable report notifications, choose their notification language, or remove their membership.

Alert statistics and resync

Use Alert Statistics to inspect downloaded alerts by local account date. Move between weeks with the arrow buttons or choose a date in the date picker. If a source day needs correction, choose a past date and select Reset. The next alert download refreshes that day’s source alerts. Future dates cannot be reset. Resetting a date is a corrective action—confirm the date before using it.

In the same settings area, use Regenerate heartbeat for a date when historical heartbeat data needs to be rebuilt. Choose a local past date and select Regenerate heartbeat. The next heartbeat download refreshes heartbeat data for that local day only; the button shows when the request is being processed.

Step-by-step: create and configure an account

1. Open Accounts. To create an account, enter the account name and required email domain, optionally choose a parent account, and select Create.
2. Select the account name to open Admin. Confirm the account name, email domain, creation time, and current parent.
3. In Parent account, choose None or a parent account, then select Update parent. Do not create a cycle in the account hierarchy.
4. In Settings, enter the DEVO identifier, confirm the email domain, choose the account time zone, and select Save.
5. In Whitelist / blacklist, select Add entry, choose Whitelist or Blacklist, choose the target type, enter its value, and select Save whitelist / blacklist. Remove obsolete rows before saving.
6. In Data Sync, enter the required lookback in Days to sync (1–3,650), review the current alert and heartbeat periods, and select Reset sync period. This resets both periods.
7. Enter Alert retention days (1–40) and select Save in the Settings section to store the retention value.
8. In Users, enter the email address of a user who has signed in at least once, choose a role, and select Add. Use the role control to change a membership later.
9. For a user who should receive account report notifications, check Enabled in the Notifications column, choose English, Taiwan Chinese, or Japanese, and wait for the update confirmation. Select Remove only when the membership should be deleted.
10. Return to Accounts and verify the account’s parent, domain, time zone, and user count in the table.

Step-by-step: correct an alert date

1. Open the account’s Admin page and scroll to Alert Statistics.
2. Use the week arrows or date picker to find the account-local date that needs correction.
3. Review the downloaded count and latest alert time for that date.
4. Select Reset on the past date and confirm that it is the intended source day.
5. Wait for the next alert download. The selected date is queued as the alert sync window and will be refreshed then.

Step-by-step: regenerate heartbeat data for a date

1. Open the account’s Admin page and go to the heartbeat or Data Sync settings.
2. In Regenerate heartbeat for a date, choose the local date that needs repair.
3. Select Regenerate heartbeat and wait for the confirmation that the request was queued.
4. Wait for the next heartbeat download, then return to the account settings or Compliance page to verify the refreshed day.

This action refreshes only the selected local day. Confirm the account and date before submitting the request.

These actions require account-management permissions. Changes are saved per account; verify the selected account before editing settings or resetting alert data.

Account hierarchy and notification recipients

The Parent account control changes the account hierarchy. Choose None to make an account a root account, or select another manageable account to make it a child. SIEM+ prevents self-parenting and descendant cycles. A user can receive account report notifications only after they are a member of the account and the notification switch is enabled.

Account administrators and owners can also open Access history from the account settings page to review access by users, integrations, and support.