Glossary
Every term used across these docs, in one place.
The wt15-server-agent — a single unprivileged binary that runs on a host and
reports telemetry, system information and logs. See the
server agent overview.
The general capability that turns check findings into incidents and notifications. See Alarms & alerting.
Alarm policy
Section titled “Alarm policy”A routing rule that delivers an incident to targets (users, contact groups, or everyone) over one or more channels.
Alarm rule
Section titled “Alarm rule”A single condition evaluated against a resource’s checks. Rules are either boolean (pass/fail, escalating on a consecutive-failure streak) or metric (a numeric threshold). See the rule catalogue.
Auto-tagging
Section titled “Auto-tagging”See server-led tagging.
Change detection
Section titled “Change detection”Comparing a scan result to the previous successful one and flagging what changed (used for DNS, SSL, domain-expiry and WHOIS). Transient outcomes are excluded so blips aren’t treated as changes.
Check / Scan
Section titled “Check / Scan”A single evaluation of a resource — agent telemetry, or an outside-in probe such as DNS, SSL, reachability or response. Records a status and an outcome. See monitoring.
Contact group
Section titled “Contact group”A named set of people that an alarm policy can target as a unit.
Domain
Section titled “Domain”A resource representing a public domain, watched outside-in for DNS, certificate, expiry and reachability.
Enrollment
Section titled “Enrollment”The one-time process where an agent registers a host into your organisation using an organisation token, receiving its identity and secret.
Incident
Section titled “Incident”An open problem for a resource, opened by an alarm rule,
carrying a severity of warning or critical. Auto-resolves when
the condition clears.
journald source
Section titled “journald source”Logs shipped by the agent from the systemd journal, labelled with the
log source journald.
Log source
Section titled “Log source”A label on each log line identifying where it came from — by default a file’s
basename, or journald. A first-class field you can filter on in
log search.
Notification channel
Section titled “Notification channel”The medium an alarm policy delivers through: email, Slack,
Microsoft Teams, or a generic webhook.
Organisation
Section titled “Organisation”The top-level tenant. Every resource, tag, log line and audit record is scoped to one organisation; access within it is governed by roles & permissions.
Outcome
Section titled “Outcome”The finding of a check: data_found, no_data,
target_not_found, blocked, or lookup_unavailable. blocked and
lookup_unavailable are excluded from alarms and change detection.
Permission
Section titled “Permission”A granular module.tier grant (e.g. domains.edit, logs.view). Bundled into
roles. See the permission catalogue.
Profile (server agent profile)
Section titled “Profile (server agent profile)”A named bundle of agent configuration — collection intervals, log files, and tagging rules — shared by many hosts and updated centrally. See fleet & profiles.
Resource
Section titled “Resource”Anything monitored and metered: a server, a domain, or a service.
A named set of permissions, scoped to an organisation. Built-ins are Admin and Regular Users; custom roles are supported and a user may hold several.
Server
Section titled “Server”A resource representing a host, watched inside-out by the agent.
Server-led tagging
Section titled “Server-led tagging”The agent reading identity metadata from AWS, Docker and Kubernetes at enrollment and reporting it as tags, subject to the profile’s advanced-tagging filter. Also called auto-tagging. See tagging.
Service
Section titled “Service”A resource representing an endpoint (HTTP/TCP/UDP), watched outside-in for reachability and response.
Severity
Section titled “Severity”The urgency of an incident: warning or critical. Metric rules
compare to thresholds; boolean rules escalate on consecutive failures.
Single sign-on with Google or Microsoft, with DNS-verified domains and per-organisation enforcement. See SSO.
Status
Section titled “Status”The execution health of a check: queued, running,
completed, failed, timeout — distinct from its outcome.
A value inside a tag group, applied to resources to organise, filter and target them.
Tag group
Section titled “Tag group”The key or category a tag belongs to. System groups (Organisation-wide, Server, Domain, Service) scope which resource types a tag can apply to.
Telemetry
Section titled “Telemetry”The high-frequency host vitals the agent reports every 60 seconds (CPU, memory, disk, network, load). See metrics & telemetry.
Verified domain
Section titled “Verified domain”A domain an organisation has proven it controls via a DNS TXT record, used to anchor SSO enforcement.
Zero-privilege
Section titled “Zero-privilege”The principle that the agent runs with no root and an empty Linux capability set. See the privilege model.