Skip to main content

Security

Where to find it: Workspace → Operation → Security (/operation/security). It needs the security:read permission; without it, this page is not reachable. It is per-project, so pick the project in the sidebar's project selector first.

This page is where you set up recurring, automated security reviews of your cloud account. Instead of auditing your infrastructure by hand, you create a schedule and an agent checks it for you on a repeating basis, handing back a plain-language security report. Security checks are report-only: they do not open incidents or cards by themselves, though you can create a card from a finished report (see Schedule history and reports).

The subtitle under the page title reads "Create scheduled security checks and browse run history per schedule." and, once a project is selected, adds Project: <name>.

The page header controls​

  • New schedule: only shown if you can manage security checks (see Permissions). Toggles the new-schedule form open and closed below the header.
  • Rules: always visible, disabled until a project is selected. Opens the Security rules dialog. Anyone who can view this page can open it, even without manage access.
  • Refresh icon button: re-fetches the schedule list. Spins while a fetch is in progress.

How do I create a schedule?​

Click New schedule to expand the form (titled "New scheduled security check"). A Cancel link in the form's top-right corner collapses it again and clears any validation errors.

  • Title (required): free text, for example "Prod API weekly review".
  • Prompt for the agent (required): what you want the agent to check.
    • Above the text box, preset buttons let you start from a template: AWS security analysis (fills in "Perform an AWS security analysis of my account.") and Custom (clears the box for you to write your own). The preset that is currently active is highlighted.
    • Typing directly into the text box automatically switches the selection to Custom.
    • The form opens with the AWS security analysis preset pre-filled and selected.
  • Repeat (required): a dropdown: Daily or Weekly. Defaults to Weekly.
  • Time (UTC): a 24-hour time picker (hour and minute), stored and displayed in UTC. A note under the field reads "24-hour UTC — e.g. Friday 22:41". Defaults to 08:00.
  • On (required, weekly only): appears only when Repeat is Weekly. Seven day-abbreviation buttons (Mon–Sun) to pick the weekday. Defaults to Friday.
  • Preview: a read-only box showing the schedule in plain language (for example "Every Friday at 08:00 UTC") and the computed next-run date and time, updating live as you change the fields above.
  • Post results to communication channels: a switch, on by default. Description: "Scheduled runs open or continue their linked Slack and Teams thread. Run now always stays inside ACE." Turning it off keeps scheduled results inside ACE only.
  • Save schedule: validates the form (Title, Prompt, and Time are required; a weekday is required if Repeat is Weekly) and creates the schedule. Shows "Saving…" while in flight. On success, the form collapses and a green "Schedule added" message flashes next to the buttons for 2 seconds.
  • Save & run now: same validation and save, then immediately triggers a run of the new schedule. Shows "Running…" while in flight. On success, the form collapses and "Run queued — open the schedule to view" flashes for 2.5 seconds. If triggering the run fails (for example no credits, subscription past due, project budget exceeded, or the analysis service is unreachable), a toast with a specific error message appears instead, and the schedule itself is still saved.
  • Fields with a validation error show a red border and an inline error message underneath.

The scheduled checks list​

Below the form, the Scheduled checks section header shows a count badge for the number of schedules, with the note "Each card is a cron job — click to see all runs and full reports."

  • Empty state: "No schedules yet. Fill the form above and save."
  • Each schedule is a card, showing:
    • A status dot (green if enabled, gray if paused), and the schedule's Title. A "Paused" pill appears next to the title when disabled.
    • The schedule summary in plain language (for example "Every day at 08:00 UTC"), plus · Next: <date, time> if the schedule is enabled.
    • The total run count ("N runs"), then either · Last run <time ago> or "· No runs yet", then either "· Results stay in ACE" or "· Posts results" depending on the schedule's channel-posting setting.
    • If you can manage checks: a Pause (or Enable, if currently paused) button, and a trash-can Delete button.
    • A chevron on the right (also toggled by clicking anywhere on the card body) expands or collapses the card in place.

Expanding a card​

Clicking a card (or its chevron) expands it to preview recent runs:

  • Loading: "Loading runs…" with a spinner.
  • Empty: "No runs yet."
  • Otherwise, up to the 3 most recent runs, each row showing a spinner (if still running) or a green dot, the run's title (falling back to "Running…" or "Scheduled check completed"), and a time-ago stamp (or "Running…"). Clicking a run row opens its full report at /operation/security/<cronJobId>/runs/<runId>.
  • A View full history → link at the bottom of the expanded card opens the schedule's full run history at /operation/security/<cronJobId>. See Schedule history and reports.

How do I delete a schedule?​

Clicking Delete on a card opens a confirmation dialog: "Delete schedule?" with the description Delete "<title>"? Runs for this schedule will be removed. Buttons are Cancel and a destructive Delete. Confirming shows "Deleted." on success.

Security rules​

Clicking Rules opens the "Security rules" dialog. It explains: "Each schedule is the automatic analysis rule. Enabled controls whether it fires; Post controls scheduled channel delivery. Run now always stays inside ACE."

  • A banner at the top: "Posting requires a project communication channel." with a Manage channels → link to /integrations/communication.
  • If there are no schedules: "Create a schedule to define security rules."
  • Otherwise, one section per schedule, showing its title and plain-language summary, with two switches:
    • Enabled: "Allow the scheduler to create future runs."
    • Post results to communication channels: "Open or continue this run's Slack or Teams thread."
  • A closing note: "There is no Automatic analysis switch: executing the analysis is the purpose of the schedule."
  • If you cannot manage checks, both switches are disabled and the only button is Close.
  • If you can manage checks: the Save rules button saves every schedule's Enabled and Post setting at once (disabled if there are no schedules, or while saving, which shows a spinner). The other button reads Cancel. A save failure shows red text with the server's error message, or a generic "Could not save security rules." fallback.

These are the same Enabled/Pause and Post settings shown on each schedule card and on the full history screen; the Rules dialog just lets you review and edit all schedules for this check type in one place.

Permissions​

  • security:read: required to open this page at all.
  • security:manage: required to see New schedule, use Pause / Enable / Delete on a card, and save changes in the Rules dialog. Also required (together with the project not being in a read-only or non-mutable state) to trigger a run.
  • Without security:manage, the page is still fully browsable. You can see every schedule, expand cards, view full history, and open the Rules dialog (read-only, with a Close button instead of Save rules).
On this page