Spectra Detect Manager Navigation — Header Menus, Notifications, and Risk Tolerance

The header bar at the top of every Spectra Detect Manager (SDM) page gives you access to all of its features: the dashboard, the configuration and administration menus, help, notifications, your user settings, the risk tolerance level, and the status of your connectors. This page describes each item in the order it appears in the header, from left to right.

1QUOTA2Dashboard3Central Configuration4Administration5Help678Risk ToleranceDEFAULT9Integrations:

Spectra Detect Manager header, simplifiedClick a part of the header or an item in the list to highlight it.

1. Quota: Spectra Intelligence quota usage for the accounts that the connected appliances use.
2. Dashboard: statistics about the files analyzed on connected Workers, and the status of SDM and every connected appliance.
3. Central Configuration: settings for Spectra Detect appliances, managed from SDM so they stay consistent across appliances. Spectra Analyze appliances are configured through the SDM API instead.
4. Administration: SDM settings, YARA ruleset synchronization, users and API tokens, redundancy, backup and restore, update packages, email alerts, licensing and certificates.
5. Help: this documentation and the SDM API reference.
6. Notifications: the bell icon, with your unread notifications.
7. User menu: your profile, your notification settings, and logout.
8. Risk Tolerance: the active risk tolerance level, which can override sample classifications for every connected appliance.
9. Integrations: the connectors configured on your Hub groups, for files coming in and for files and reports going out.

Quota

Quota shows the usage of the Spectra Intelligence accounts that your configuration groups use. It appears next to the Spectra Detect logo, but only if Spectra Intelligence is enabled for at least one configuration group, and that account has a daily or monthly quota. The usage refreshes every minute.

The label summarizes all quotas, for example Quota, Quota(2) when several quotas are tracked, or 2 Quotas Limit Almost Reached. It's highlighted when a quota reaches 90% of its limit, reaches the limit, or expires.

Click the label, or the arrow next to it, to see the details for each account. Hover over an account name to see which configuration groups use it. For each quota, you see whether it renews daily or monthly, or the date it expired, and a bar with the usage and limit of each product. A product without a limit shows Unlimited. A product marked [Disabled] has reached its limit or expired.

To ask for a higher quota, click Increase Your Quota at the bottom of the list. This opens an email to ReversingLabs Support.

Help

The Help menu contains the following items:

• Open User Guide: opens this documentation.
• API Documentation: opens the SDM API reference for the version running on your appliance, with example requests and responses for each endpoint. You can also download the OpenAPI specification from there.

Notifications

Click the bell icon in the header to see your unread notifications. To see all notifications, click See all notifications. This opens the notifications page.

The notifications page lists your notifications in a table:

• Type: the type of notification.
• Time: when the event happened.
• Notification: a short description of the event, for example a classification change from unknown (no threats found) to malicious.

To narrow down the list, use the filters next to it: Filter by Period, Filter by Read Status, Filter by Notification Type and Filter by Classification.

To see more about a sample, click its hash in a notification. This opens it in Dashboard > Analytics > Detections Overview.

To mark all notifications as read, click Mark All as Read.

To choose which events create notifications, and how they're delivered, see Notification Settings.

User Menu

Click the user icon in the header to open the user menu. It shows your username and the following items:

• My Details: your profile. For more information, see My Details.
• Notification Settings: your notification rules. For more information, see Notification Settings.
• Logout: logs you out of SDM and returns to the login page. SDM doesn't ask for confirmation.

My Details and Notification Settings open the same page, on its Profile and Notification Settings tabs.

My Details

On the Profile tab, you can change your First Name, Last Name and Email.

To change your password, enter the new password in New Password and Repeat New Password, enter your Current Password, and click Save.

Notification Settings

The Notification Settings tab lists your notification rules, with their Name, Type, Alert, Description and Actions. To change how many rules the table shows per page, use the drop-down list below the table.

• To add a rule, click Add Notification. For more information, see Adding a Notification.
• To edit a rule, click the pencil icon in its row. This opens the same dialog as Add Notification.
• To delete a rule, click the delete icon in its row.

If cloud classification changes are disabled, a banner at the top of the tab says so. To enable them, go to Administration > Spectra Detect Manager > Dashboard Configuration, and select Subscribe to Cloud Classification Changes. For more information, see Dashboard Configuration.

To see the notifications that your rules create, see Notifications.

Adding a Notification

To add a notification rule:

1. Click Add Notification.

2. Enter a Name and, optionally, a Description.

3. Select a Notification Type, and set what triggers the notification:

   • Cloud Classification Changes: a sample's classification in Spectra Intelligence changes. In Cloud Classification Changes From, select the old classification, and in Cloud Classification Changes To, the new one.
   • Classification Detections: a sample gets one of the selected classifications. In Classification Detection, select the classifications. To limit the rule to some ways of submitting files, in Ingestion Source, select them, for example API or AWS S3. If you don't select any, the rule applies to all sources.

   For both types, you can select Unknown (No Threats Found), Goodware, Suspicious or Malicious, and you can select more than one.

4. Select one or more delivery methods: Notify Using E-mail, Notify Using Splunk or Notify Using Syslog. Each one enables a tab of the same name below.

5. On each enabled tab, fill in the fields described in the following tables.

6. Click Add. The button stays disabled until you fill in all the required fields.

E-mail

To send notifications by email, SDM needs an SMTP server. To set it up, go to Administration > Spectra Detect Manager > SMTP. For more information, see SMTP.

Field	Description
Email Addresses	Required. The recipients' email addresses, one per line.
Email Notification Frequency	How often notifications are sent: every 15, 30 or 45 minutes, every 1, 2, 4, 8 or 12 hours, or every 1, 2 or 7 days. Default: 15 minutes.

Splunk

Field	Description
Splunk Protocol	http (default) or https.
Splunk Host	Required. The Splunk host.
Splunk Port	Required. The Splunk port.
Splunk Token	Required. The Splunk token.

Syslog

Field	Description
Syslog Server	Required. The Syslog server.
Syslog Port	Required. The Syslog port.
Syslog Protocol	UDP (default) or TCP.
Syslog Tag	Required. The tag added to each message.
Syslog Priority	The message priority. Default: 0.

Risk Tolerance

Risk Tolerance Levels let you override a sample's final classification, based on how confident the verdict is and whether network threat intelligence found a malicious indicator. The setting is global, which means it applies to every appliance and configuration group connected to this SDM, with no per-group override.

tip

Risk Tolerance Levels can also be set up in Spectra Analyze. Spectra Detect's version overrides based on the Worker's own classification confidence and network threat intelligence, since Spectra Detect doesn't run the additional analysis sources (Cloud Sandbox, Joe Sandbox, configurable YARA rulesets) that Spectra Analyze does.

If a file is analyzed by both products, each applies its own Risk Tolerance level and neither takes precedence — these are separate analyses that can reach different classifications. Risk Tolerance is only one reason the results can differ: processing settings (best, fast), the decompression factor, ML model configuration and other factors also influence the outcome.

For more information on how classification and risk factors work together, see Classification.

Risk Tolerance Levels Comparison

	High	ReversingLabs Default	Low
Best for	Environments that minimize noise and act only on the highest-risk threats.	Standard deployments that require unmodified engine verdicts.	High-security environments where network-based indicators of compromise are treated as critical threats.
Threat Verdict	Samples classified as Suspicious, or Malicious with an RCA2 factor of 6 or below, are overridden to Goodware with an RCA2 factor of 5.	No override is applied. The top-level verdict follows the standard engine evaluation.	The top-level container classification is elevated to Malicious with an RCA2 factor of 6 when a malicious network indicator of compromise (IOC) is found.
Network Threat Intelligence	Doesn't impact final classification.	Doesn't impact final classification.	Findings are included in the classification decision.
Report Output	Adds a top-level administrative override scanner entry with the reason "High threat level tolerance - ignoring all low threat levels". Previous low-threat scan results are marked as ignored.	Report remains unchanged from the standard engine evaluation.	Adds a top-level administrative override scanner entry with the reason "Overriding to malicious due to malicious network IOCs found".

Selecting a Risk Tolerance Level

Only Superuser accounts can see and change the Risk Tolerance setting.

1. In the SDM header, click Risk Tolerance. The button shows the currently active level.
2. In the Risk Tolerance Levels dialog, review the available levels and their effects.
3. Click the desired level to select it.
4. Click Apply Changes to save the selection, or Cancel to close the dialog without changes.

The active level is indicated with a green checkmark and the (Active) label.

warning

• Choosing High reduces the number of alerts you receive, but may also cause genuinely malicious low-confidence samples to be classified as Goodware. Choosing Low increases detection of network-based threats, but may also increase false positives from network indicators alone.
• Global and advanced filters use a sample's final, post-override classification to pass or drop files.

Integrations

The Integrations indicators on the right side of the header show which connectors are configured on your Hub groups. Hover over an arrow to see the details:

• The down arrow shows File Ingress Connectors: the connectors that bring files into Spectra Detect.
• The up arrow shows File Egress Connectors: the egress integrations that deliver files and analysis reports to other systems.

Each list groups the configured connectors by category, for example AWS or Email, and shows the Hub groups each one is configured on. Connectors that aren't configured on any Hub group are listed under Connectors Available for Configuration. If no connector is configured, the arrow is grey and the list shows No Connectors Configured.

Configured only means that a configuration exists. It doesn't mean that the configuration is correct, or that the connection works.

To configure an ingress connector, go to Dashboard > Appliance Management, select the primary Hub of the Hub group, and from the Actions drop-down, select Connectors. To configure an egress integration, go to Central Configuration > Egress Integrations.