Accounts and sign-in
Roles, the second factor, passwords and SSH keys, what happens when someone leaves, and what Legit AI staff can and cannot see.
Add people in Admin → Users → Add User. Each person has one role:
| Role | Can |
|---|---|
| VIEWER | Read alerts, events, investigations and reports |
| ANALYST | Everything a viewer can, plus triage alerts, request response actions and approve another person’s request |
| ADMIN | Everything an analyst can, plus manage users, keys and agents |
Admin → Roles & Permissions builds a custom role. Nobody can hand out more than they hold, and a custom role cannot change an ADMIN’s account.
The second factor
Section titled “The second factor”A new account scans a QR code into an authenticator app and types a code before its first session. Signing in with an SSH key asks for the same code.
Sensitive actions, such as a terminal session or a network scan, ask for a fresh code each time, and each code works once.
After 8 failed attempts on one account, or 20 from one address, sign-in is blocked for 15 minutes.
Password, e-mail and SSH keys
Section titled “Password, e-mail and SSH keys”Settings → Security → Change Password asks for the current password. The change signs you out everywhere else. Changing your e-mail address or adding an SSH key asks for the password too.
If you have lost your password, see Quickstart.
When someone leaves
Section titled “When someone leaves”Suspending or removing a person ends every session of theirs at once, along with any open terminal and live alert connection. Their API keys stop working too; see API keys and roles.
A lowered role applies from the next request. A raised role applies from the next sign-in.
What Legit AI staff can see
Section titled “What Legit AI staff can see”Staff cannot open your organisation at will. A support session:
- is read-only;
- is opened with a written reason and the staff member’s own second factor;
- lasts 30 minutes by default and 60 at most;
- appears under Plan & Usage, with who opened it and why.
To help someone back in, staff send a one-time link. They never see a password.