Configuration Reference
What you can configure after installation, and where each setting lives. Most day-to-day configuration happens in the console rather than in files; this page covers both and says which is which.
Platform settings
Set in Settings in the console, scoped to what your role manages.
| Setting | Description | Default |
|---|---|---|
| Deployment display name | The name shown in the console header | EmberNet |
| Timezone | Default timezone for timestamps and logs | UTC |
| Session timeout | How long an idle session stays valid | 30m |
Authentication
There is no local password configuration, because there are no local passwords. Sign-in is delegated entirely to your identity provider, and role and tenant scope are resolved from its group claims.
Everything configurable about authentication is covered in SSO Integration: the app registration, the group claim, the group-to-role mapping, and the bearer-token path used by EmberNet Endpoint.
The one thing worth repeating here: do not enable group enforcement at the proxy layer. The platform enforces the same boundary itself, and endpoint daemons carry no group claim, so turning it on breaks them.
Data retention
Telemetry ages through three tiers. Retention is a platform-level setting, not a per-tenant one.
| Tier | Where it lives | Default |
|---|---|---|
| Hot | Edge node | 7 days |
| Warm | Edge cluster | 30 days |
| Cold | Cloud storage | 365 days |
Warm and cold tiers are downsampled on ingest, at a one-minute interval by default. Hot retention is the tier worth tuning per deployment size, because it is the one bounded by local disk. See System Requirements.
Telemetry sources
Each protocol a device speaks is configured per device rather than globally. Registration and credentials live in Device Monitor; SNMP specifically is covered in SNMP Configuration.
The defaults that apply when you don't specify otherwise:
| Protocol | Default port | Default polling | Notes |
|---|---|---|---|
| OPC UA | 4840 | 1s | Security mode defaults to SignAndEncrypt with Basic256Sha256; subscription-based change notification is preferred over polling where the server supports it |
| Modbus TCP | 502 | 1s | Unit ID defaults to 1 |
| SNMP | 161/UDP | 60s | v3 preferred; v2c supported |
| MQTT | 8883 (TLS) | n/a | See below |
| BACnet/IP | 47808/UDP | 60s |
Device Monitor supports a further eleven industrial protocols beyond these; the full list is on that page.
MQTT
AnvilMQ listens on 8883 for TLS, which is the configuration you should be using, and on 1883 for plaintext. Point integrations at 8883 unless you have a specific reason not to; a broker reachable in the clear on a plant network is worth avoiding.
Alerting
Alert conditions are built in and fixed. There is no rule-authoring schema, because there are no user-defined rules. What you configure is where alerts go and how often they repeat.
| Setting | Default |
|---|---|
| Degraded-state threshold | 10 minutes |
| Re-notify cooldown | 15 minutes |
Two delivery channels exist:
| Channel | Configuration |
|---|---|
| SMTP server, credentials, recipients | |
| Webhook | URL, method, headers, payload template |
SMS and third-party on-call integrations such as PagerDuty are not built in. If you need paging, route the webhook into a system that does it. See Alerts & Notifications for what fires and when.
Networking
The zero-trust mesh is on by default and needs no configuration to work. What you may need to set:
| Setting | Purpose |
|---|---|
| Outbound HTTP proxy | If your network requires egress through a proxy |
| Outbound HTTPS proxy | Same, for TLS traffic |
| Custom DNS servers | If the host's resolvers aren't appropriate for the site |
No inbound configuration exists, because the platform makes no inbound connections. See Zero-Trust Networking.
Next steps
- SSO Integration: the authentication configuration that matters
- Alerts & Notifications: what the platform alerts on
- SNMP Configuration: getting metrics out of network devices
- Storage: capacity, guardrails, and backup targets