Get started with the hosted console¶
The hosted console at app.untrustsecurity.com is where your organization keeps everything untrust knows about your confidential deployments: scan reports, CI receipts, collector evidence, detections, trust decisions and policies.
Sign in¶
You sign in through your organization's identity provider (OpenID Connect). An administrator in your organization invites you with a one-time link; see Organizations, projects and roles. There is no self-service sign-up: an identity becomes a member only through an invitation.
First-time setup¶
A new organization starts in setup (Open setup in the console), which has four steps:
- Cloud account: register the deployment you run (AWS Nitro Enclaves, GCP Confidential Space or Azure confidential VMs), grant untrust a scoped, read-only identity, and test it. See Connect a cloud account.
- Pipeline: register the repository that builds your workload and download a generated workflow for build and IaC gates. See Send evidence from CI.
- Integrations: where alerts go (signed webhook, Slack, PagerDuty). See Alerts and webhooks.
- Review: a preflight of what is connected, and the baseline.
Only an administrator can complete setup steps that change the organization.
Upload a scan report¶
The console does not scan your cloud accounts from its own servers. Scans run where your credentials are, on your workstation or in CI, and you upload the JSON report:
- In the console: choose Scan now in the header, then Choose report.json. The dialog also shows the scan command, prefilled for your registered connections.
- From the command line, with an organization API key that can write:
untrust scan --platform nitro ... --output report.json
untrust report-upload report.json \
--org-url https://app.untrustsecurity.com/v1/organizations/<org> \
--api-key "$UNTRUST_API_KEY"
The uploaded scan appears under Connections, and its findings under Findings.
Find your way around¶
The sidebar groups the console by lifecycle stage. The console tour covers every page, its tabs and the role each action needs.
| Section | Pages | What they show |
|---|---|---|
| Overview | Live posture, Findings, Trust Graph, Trust decisions | The current state, every finding, how failures chain into attack paths, and every key release untrust gated or observed. |
| Inventory | Assets & environments, Platform & TCB | What is deployed, which confidential instances no scan covers, and each host's platform and firmware level. |
| Build | Source analysis | Build-scan receipts and rules. |
| Infra | IaC scan, Key binding | IaC receipts, and whether key-release policies bind to attestation. |
| Supply | Image Registry, Reproducible builds | Artifacts by digest, signatures, measurements. |
| Attest | Attested TEEs, Reported claims | Verified hardware evidence from collectors, and measurements and configuration hosts report. |
| Test | Active tests, Verifier probe | Opt-in active testing against staging. |
| Runtime | Runtime Detections | Detection events and rule coverage. |
| Governance | Policies, Compliance | Policy roll-up and release gates; compliance frameworks and evidence packs. |
| Settings | Connections, Reports & trends, Settings | Evidence sources and their freshness, posture over time, members, API keys and organization settings. |
| Help | Docs | The in-console reference: the same check and rule reference as this site. |
Read results honestly¶
- FAIL is a weakness to fix. SKIP and ERROR are not assessed: they are never counted as passing.
- A source that has not reported within its expected interval is stale. Views that depend on it show a stale-data banner that links to Connections, and its last result is never shown as current.
- Evidence the service could not verify is labelled unverified.
- CI uploads are authenticated submissions: untrust knows which pipeline sent them, but that does not make the scan inside them a verified attestation.
API¶
Everything the console shows is available through the organization API. The OpenAPI 3.1
description is at https://app.untrustsecurity.com/v1/openapi.json (no authentication
needed) and in the console under Settings › API reference. Each operation names the
narrowest API key role that can call it.
untrust api get https://app.untrustsecurity.com/v1/organizations/<org>/issues