uControlSettings — Configuration UI
The Settings page is uControl Insight's central admin UI for runtime configuration. From here
you can change AI, asset aging, discovery, flow ingestion, Teams notification, and authentication
options without editing application.yml or restarting the service for most changes.
Who can use it
Only users with the ADMINISTRATOR role. The Settings sidebar entry and all underlying URLs are gated.
Where to find it
Log in → sidebar → Settings (near the bottom, under Authentication — which is itself now a tab inside Settings).
What you can configure
Tab | What it covers | Hot-reload? |
|---|---|---|
General | Global default language — the fallback UI language (English, French, German, Spanish, Italian) used for users who haven't chosen their own on their Profile. Notification language — sets the language used for outbound Microsoft Teams alerts and the daily AI digest. It is separate from each user's own interface language because notifications are sent to a shared channel. | Yes — users without a personal preference pick up the new default on next page load; the next outbound notification uses the new notification language. |
✨ AI | Master switch, provider (OpenAI / Anthropic / Ollama), per-provider model and API key, request timeout, log tail size, per-feature toggles (Scan-failure diagnosis / Ask uControl / Daily digest). | No — AI provider changes need a service restart. Feature toggles take effect on next call. |
Asset Aging | Sweeper enable, STALE / INACTIVE thresholds (days × failure-count), cron schedule. | Yes for thresholds; restart for cron schedule. |
Discovery & Flow | Default scan timeout, max concurrent targets; NetFlow/IPFIX ports; flow batch size and interval; relationship-sync toggle; asset-id backfill toggle and lookback. | Yes for tuning values; restart for port and backfill changes. |
Notifications | Teams enable, webhook URL, optional HMAC shared secret, base URL used in card deep-links. | Yes — next outbound notification picks up the change. |
Authentication | Auth mode (Local / LDAP / Hybrid / SAML / OIDC), LDAP server config, SAML metadata, OIDC issuer, group-to-role mappings. | Some changes need a restart — the UI flags which. |
How configuration is stored
Values you save are written to the app_settings table in the uControl database.
Read order at runtime:
Database (from this UI)
Environment variables (e.g.
UCONTROL_AI_ENABLED)application.ymldefaultsBuilt-in fallbacks
So you can still bootstrap a fresh install from environment variables or the YAML file, then override values one-by-one in the UI as you go.
How secrets are protected
Anything marked as a secret (AI API keys, Teams HMAC, LDAP manager password, OIDC client
secret) is encrypted at rest using AES-GCM with a master key (configured via
UCONTROL_MASTER_KEY at install time). Secrets are never shown back in
the UI — instead, fields with an existing secret show "•••• (leave blank
to keep current)". To rotate, paste a new value and save; to keep the existing value, leave the
field blank.
Auditing
Every change is logged at INFO level in catalina.out with the username and key
name.
Reverting to defaults
There's no UI "reset" button yet — to revert a single key to its file/env default, an
administrator can delete the row from app_settings directly:
DELETE FROM app_settings WHERE setting_key = 'ucontrol.ai.enabled';
The next read falls back through the lookup chain to whatever is in your environment or
application.yml.