Looking after the platform
On your own server — what runs by itself, what you do in the console, and what Legit AI does for you.
On your own server the platform looks after most things itself. The rest is split between you, in the console, and Legit AI.
| Who | How | |
|---|---|---|
| Backing up the whole platform | Automatic | Every night; the last 14 are kept on the server |
| Exporting your organisation’s data | You | Admin → Backup & Restore |
| Detection rules and threat intelligence | You | Settings → Offline updates, from a signed bundle |
| A new version of the platform | Legit AI | Remotely or on site; everything is backed up first |
| Restoring a nightly backup | Legit AI | Remotely or on site |
| Changing a setting | Legit AI | At your request |
Backups stay inside the server they protect until you send them elsewhere. To survive losing the server, set LEGIT_BACKUP_COPY_TO to a mounted folder or user@host:/path, and LEGIT_BACKUP_KEY. Copies are sealed with AES-256 first, and nothing is sent without that key. Keep that key and LEGIT_SECRET_MASTER_KEY off this server: without them a copy cannot be opened and stored credentials stay locked.
An overdue backup raises a Platform Backup Overdue alert, and Admin → Backup & Restore shows the last good backup and the last restore test.
Export your organisation’s data
Section titled “Export your organisation’s data”Admin → Backup & Restore → Download Backup Now saves your organisation’s alerts, assets, indicators, investigations, cases, evidence, analyst notes and detection rules as one JSON file. Events themselves stay in the nightly backup.
Restore from a Backup File brings an export back. It adds what is missing and never overwrites what is already there, so it is safe to run on a platform that has been in use since. Only an ADMIN can export or restore, and each is written to the audit log.
Rule and intelligence updates
Section titled “Rule and intelligence updates”New detection rules and threat intelligence arrive between versions as a signed bundle. An administrator uploads it in Settings → Offline updates, checks it and applies it; nothing is applied unless Legit AI’s signature and every file in it check out. See Offline updates.
A new version
Section titled “A new version”A new version of the platform is installed by Legit AI, remotely or on site, the same way as the first. The installation backs up the whole platform first and keeps your settings and data; the console is unavailable for a few minutes while it restarts.
Changing a setting
Section titled “Changing a setting”These are set at installation and changed by Legit AI at your request:
| Setting | What it decides |
|---|---|
| The console’s address and certificate | The name people open, and the certificate it is served with — your own CA’s, or one made at installation |
| Networks allowed to send syslog | By default every private network; narrowed to the networks your devices are in |
| A syslog sender on the platform’s own server | Refused by default, because it reaches the receiver without its own address |
| Outside lookups | On a server with internet: IP location, the Tor exit list and vulnerability feeds. Off unless you ask |
| Ports | 443 for the console, 514 for syslog, unless they are taken |
| The AI model | Chosen for the server; switched off, or moved to a GPU added later |
When something is wrong
Section titled “When something is wrong”Contact Legit AI support with what you see. If we need the platform’s own diagnostics, we collect them in a session you open — the services’ recent logs, their state and the server’s resources, with every password, key and token removed — and we close it when we are done.