Settings · Vardhold docs

Settings live in the dashboard under Settings. Every change needs administrator confirmation and is recorded in the audit log.

General#

Setting	Default	Meaning
`retentionDays`	`30`	How long events stay in the local database (1–3650). Exported copies are kept by your SIEM's own retention.
`failMode`	`closed`	What the hook and MCP proxy do when the service cannot be reached. `closed` blocks the action; `open` lets it run. Keep `closed`.
`approvalTimeoutSeconds`	`60`	How long ask rules without their own `timeout_seconds` wait for a person (5–3600).
`autoSuspendOnDetectBlock`	`false`	Suspend an agent when telemetry shows it did something a block rule forbids. Applies only to headless agents (CLI agents and MCP servers), never to desktop or IDE apps a person is using.

Exports#

Splunk#

Setting	Default	Meaning
`enabled`	`false`	Send events to Splunk
`url`	–	The HTTP Event Collector endpoint, `…/services/collector/event`
`token`	–	The HEC token. Encrypted at rest; must be entered again when the URL changes.
`index`	`main`	Destination index
`sourcetype`	`vardhold:ocsf`	Source type
`verifyTls`	`true`	Check the server certificate. Keep on.

Syslog#

Setting	Default	Meaning
`enabled`	`false`	Send CEF events over syslog
`host`, `port`	`127.0.0.1`, `514`	The collector
`protocol`	`udp`	`udp`, `tcp` or `tls` (RFC 5425, usually port 6514)
`verifyTls`	`true`	For `tls`: check the certificate against the machine's trusted roots and the host name

Files#

Setting	Default	Meaning
`enabled`	`false`	Write OCSF NDJSON files
`directory`	–	The folder to write to

Redaction#

Before anything is stored or exported, Vardhold hides secrets in commands, paths and arguments. The default patterns cover:

password=, token:, api_key= and similar key-value pairs (only the value is hidden, so the rest of the command stays readable)
Bearer tokens
Common API key formats, such as OpenAI-style sk- keys, GitHub personal access tokens and AWS access key ids

Add regular expressions for your organisation's own secret formats under redaction.patterns. A pattern with a named group secret hides only that group; otherwise the whole match is hidden. Invalid patterns are rejected when you save.

Changing settings from a script#

Settings are also available through the local API with the administrator token, which only an elevated process can read:

PowerShell

$token = Get-Content "$env:ProgramData\Vardhold\admin.token"
$h = @{ 'X-Vardhold-Token' = $token }
$s = Invoke-RestMethod http://127.0.0.1:47823/api/v1/settings -Headers $h
$s.retentionDays = 90
Invoke-RestMethod http://127.0.0.1:47823/api/v1/settings -Method Put -Headers $h -ContentType application/json -Body ($s | ConvertTo-Json -Depth 5)

The Splunk token is returned masked as ********. Sending the mask back keeps the stored token, as long as the URL is unchanged.