Start a private evaluation

1. Choose the right surface

This website is documentation, not a data plane. The Evidence Room is a separate synthetic demonstration: it does not connect sources or prove cloud readiness. The actual console is a separately deployed API-backed application. Obtain its private origin and access instructions from your operator. Current stage: bounded private evaluation; integration verification pending, not general availability.

2. Agree on the evaluation boundary

Use synthetic records first. Review source permissions, allowed source identity, storage ownership, retention, network/egress, expected costs and recovery limits before enabling a worker. No credentials, raw customer evidence or provider identifiers belong in general diagnostics. The single-node evaluation is not production HA or compliance retention. This guide does not authorize provisioning or spend.

3. Inspect registration options

Set CONSOLE_URL to the operator-provided origin with no trailing slash. The public options endpoint reveals only configuration. Registration is disabled unless an operator explicitly enables it. It is limited to 32 isolated workspaces, not public SaaS or email-verified signup.

curl --fail-with-body --silent --show-error \
  "$CONSOLE_URL/api/v1/session/options"

4. Sign in with a protected cookie jar

Use an existing operator-issued account. These commands read secrets from environment variables, not literals. Set COOKIE_JAR to a private local file path and use umask 077; never commit it. CONSOLE_ORIGIN must equal the configured browser origin (normally the same as CONSOLE_URL). A loopback HTTP exception exists only for the explicit evaluation/SSM profile; use properly qualified TLS for other deployments.

umask 077
python3 - <<'PY' | curl --fail-with-body --silent --show-error \
  "$CONSOLE_URL/api/v1/session" \
  -H "Origin: $CONSOLE_ORIGIN" -H "X-Console-CSRF: 1" \
  -H "Content-Type: application/json" \
  --cookie-jar "$COOKIE_JAR" --data-binary @-
import json, os
print(json.dumps({"username": os.environ["CONSOLE_USERNAME"],
                  "password": os.environ["CONSOLE_PASSWORD"]}))
PY

5. Inspect scope and run a bounded query

Inspect the session response for workspace_name, tenant_id and role. Tenant and role are assigned by the server, never chosen in a query. An empty new workspace is expected. This query uses the default last-24-hours range and returns a SQL preview, not an unrestricted SQL editor.

curl --fail-with-body --silent --show-error \
  "$CONSOLE_URL/api/v1/events/query" --cookie "$COOKIE_JAR" \
  -H "Origin: $CONSOLE_ORIGIN" -H "X-Console-CSRF: 1" \
  -H "Content-Type: application/json" --data '{"limit":25}'

6. Follow evidence, then review

Create a scoped source in the console, inspect preflight and permissions, attach an approved external worker or import native synthetic records, and poll the ingestion operation until committed. Validate a supported rule before enabling it; inspect actual pipeline status. Follow alert evidence_ids to retained evidence, review uncertainty, and record triage. Preview a local case workflow before human approval. Delivery, query and action receipts have different meanings: do not infer one from another.

7. End the session

Logout revokes this cookie session. Clear the protected cookie jar and unset local secret variables after use. Password rotation alone does not revoke every existing session.

curl --fail-with-body --silent --show-error -X DELETE \
  "$CONSOLE_URL/api/v1/session" --cookie "$COOKIE_JAR" \
  -H "Origin: $CONSOLE_ORIGIN" -H "X-Console-CSRF: 1"