Settings

Organization details, custom branding, license and billing, single sign-on, notifications, vulnerability scanning, and API keys.

The Settings page manages your organization's account details, this dashboard's appearance, license/billing, and every admin-only integration and access-credential surface.

Organization

Rename your organization at any time from the Organization tab. Renaming regenerates the organization's slug (used in SSO login links), so an existing bookmarked SSO link changes along with it.

Branding

The Branding tab (admins only) lets you replace KubeWatch's default look with your own:

Accent color: pick a color and it colors the sidebar background (a dark, saturated shade of your color) and replaces the indigo accent used for buttons, links, and the active nav highlight throughout the dashboard.
Logo: upload a PNG or JPEG (up to 1.5MB) to replace the KubeWatch wordmark in the sidebar and browser tab.

Both are optional, independently, and default to KubeWatch's own branding until set: there's nothing to configure if you're happy with the defaults.

Branding also shows on the **login page**. For self-hosted deployments (always a single organization) this is automatic. For SaaS, the shared login page can't know which organization is signing in until a link tells it, so share `https://app.kubewatch.com/login?org=` (find your slug on the Organization tab) so your team lands on your branded login screen instead of the default one.

Capabilities

The Capabilities tab (admins only) lists every optional RBAC permission your Kubernetes agent can use and lets you switch each on or off; see Capability Management for details.

License

The License page in the sidebar shows your plan, your trial countdown if you're still in the 30-day trial, and your entitlements. Admins can enter a license key to activate a plan, deactivate an active license to revert to Free, and, for a SaaS subscription, cancel or resume it. Cancelling doesn't cut access immediately: you keep the plan until the end of the billing period you already paid for.

Usage & Limits

The Usage & Limits page tracks your agents, users, and alert rules against your plan's limits, and lets you set how long logs and metrics are retained (30, 90, or 180 days, or no limit). From here you can also export your organization's account and configuration data (users, agents, alert rules, integrations, notification channels, API key metadata, and audit log) as a JSON or CSV/ZIP bundle.

Single Sign-On

The Single Sign-On page (Enterprise plan) configures SAML login against your identity provider (Okta, Azure AD, OneLogin, and similar): paste the IdP's metadata XML, then map the user's email to the SAML NameID or an email attribute. KubeWatch shows the entity ID, ACS URL, and metadata URL your IdP app needs.

Notifications

The Notifications page manages the Slack and email channels your alert rules can deliver to: add a channel, send a test notification, and remove channels you no longer use.

Vulnerability Scanner

The Vulnerability Scanner page connects a container image scanner: Trivy or Grype (each via a small HTTP wrapper you run around the CLI, since neither tool exposes a remote by-image-name scan API on its own) or Snyk (via its own cloud API and an API token, no endpoint to configure).

API Keys

The API Keys page (admins only) creates and revokes the API keys that authenticate kubewatch-agent deployments (Kubernetes or Docker Compose) and external integrations. Keys are named and multiple can exist at once. There's no in-place "rotate" action: create a new key and revoke the old one to roll credentials over.

Session

Shows how much longer your current session is valid for.

System Update

On KubeWatch Cloud (SaaS), the System Update tab shows the currently installed version; updates are applied for you. Self-hosted installs manage updates from the standalone Update page instead.