Web GUI

Since v1.25.0. The administration GUI runs in the browser at https://<host>/app, served by the worker next to the API. It covers the day-to-day work; the CLI at /cli stays available.

v1.40.0 reworked it: quick search, an Analytics page, filters in the column headers, expandable rows with details, a collapsible menu.

Page	What you can do
Dashboard	"Is it listed?" check for any IP, network, domain or URL (with its GeoIP country); tiles with the indicator counts in total and per type and their change over the last 7 days; the Blocked card – hits per hour or day in total, by indicator type or by source, the most hit values and the reporting devices; alerts for failed and stale fetches and for devices that are offline or have failing jobs (v1.41.0+); the sources table with each count's rise or fall over 7 days.
Analytics	See Analytics below.
Sources	Filter (kind, format, tags, fetch status, visibility) and sort; create and edit feeds, import-only and manual sources (name – a generated one like young-sound-7209 to start with –, description, URL, schedule, format, tags, private, retention, options); fetch now; delete; New list from the listed sources. The details show the UUID, the export URL and tis-pull.sh call, for import-only sources the import URL and tis-push.sh call, and the lists using the source.
Indicators	Search (domain, URL, IP), filter by source, type, tags, GeoIP country and permanent flag; add values by hand; edit tags and the permanent flag one by one or in bulk; delete. Last observed is marked by freshness (within a day, a week, longer), 7d Hits with an arrow for the change against the week before.
Lists	The GUI's name for groups (/groups redirects to /lists; the API and tis-pull.sh --group keep the name). Filter by source, whitelist / blacklist entry or source and country; create and edit lists; copy the export URL (by name or UUID) and the tis-pull.sh call; the details show every entry, the UUID and the pull command.
Tokens	Create, edit, rotate and delete tokens and sub-tokens: role, permissions in an editor (export of the public list, of all or some sources and lists, import into all or some sources, API access, agent check-in, other rules), expiration (7, 30, 90 days, a year or a day from the calendar), allowed and denied client IPs. Sub-tokens are listed under their parent. The secret is shown once.
Devices	Since v1.41.0. See Devices below.
Export / Import	Export: preview any export (public, selected sources, a list) with format, type, tag, whitelist and countries, download it, copy its URL or tis-pull.sh call – referencing sources and lists by name, UUID or ID. Import: push pasted or loaded text into a source (parsed with its format and options), with the matching tis-push.sh call.
Audit log	Every change through the API, the GUI or the CLI – who, what, when, from where; filter by target, date range, who, channel and action, sort by any column; the details (the sanitised request) in an expandable row.

Quick search

Ctrl+K (⌘+K on a Mac), / or the search box in the header open a search over the pages, the common actions (new source, list or token, add or import indicators), sources, lists, tokens and – from three characters on – indicators. Picking a source, list or token opens its page filtered to it with its details expanded.

Tables

Every table filters from its column headers: the funnel next to a column name opens the filter, and is filled while the filter is on. Above the table stay the search and the active filters, each removable, with Clear filters. Filters are part of the URL, so a filtered view can be bookmarked or shared. The chevron at the start of a row expands its details.

Devices

The machines running tis-agent v0.5.0+, as they check in – one row per token and reporter: status (online, offline, the number of failing jobs), last seen, agent version and OS, the number of jobs and the hits of the last 7 days; searchable by device, hostname, token or IP, refreshed every 30 seconds. The details show the host (hostname, remote IP, uptime, agent start, first seen, hit counting), the targets, every job with its list or source, schedule, last run, result and error, entries and last change, and the history – first check-in, offline and back, new agent versions and configurations, jobs starting to fail and recovering. Forget deletes a device that is gone for good (a running one comes back with its next check-in).

Since v1.42.0 the details also show the device's central configuration (for managed agents): the pull jobs it gets with their origin – the token's template, an override or its own – and why a job can't run on its targets, whether it runs the current version or refused it; Pull all now, Pull now per job and Report hits now; the editor of the device's own jobs (override, switch a template job off, add a job – choosing one of its targets) and the latest commands with their outcome. The template is edited in the details of a top-level token on the Tokens page (Agent jobs).

Analytics

Statistics over 7, 30, 90 days or a year (UTC days), each compared with the period before:

• tiles for the live, added and removed indicators, the hits and the changes (audit log), with a sparkline;
• indicators by type and sources by fetch status as segment bars;
• live indicators, added and removed indicators and hits over time – in total, by type or by source (the largest sources, the rest as other; hits of values no source lists as not listed now, and a value listed by several sources counts for each);
• the most active sources, the top tags, countries and hit values, and the sources table with each count's change and the hits.

Every chart can be shown as a table. Clicking a source, type, tag, country or value – here, or Analytics in the row menu on Sources and Indicators – narrows the whole page to it (/analytics?sourceId=5, ?tag=malware, ?value=evil.example); All indicators goes back. Removed indicators are purged for good after the purge period, so counts older than that only include what hasn't been purged yet.

The menu on the left collapses to icons (the button at its bottom, remembered in the browser). The account menu links the API browser, the CLI and this documentation.

Signing in

1. Authentik – offered when OIDC is configured (CONFIG_OIDC_ISSUER, CONFIG_OIDC_CLIENT_ID). Authorization Code flow with PKCE; the same CONFIG_OIDC_ALLOWED_GROUPS rule as the CLI applies.
2. Admin token – the name and secret of a token with role admin (always available).

Signed-in users act as admins. The session lasts CONFIG_SESSION_TTL seconds (default 24 h) and ends with Sign out in the account menu.

Authentik setup for the GUI

The CLI uses the device-code flow; the GUI uses the authorization-code flow and needs a redirect URI. In the TIS provider (Applications → Providers → edit):

• Redirect URIs: add https://<GUI host>/api/v1/auth/oidc/callback (strict) – on the GUI's host, see Domains.
• Client type: public works (PKCE). With a confidential client set CONFIG_OIDC_CLIENT_SECRET.
• Keep the scopes incl. groups if you use CONFIG_OIDC_ALLOWED_GROUPS.

TIS builds the redirect URI from the request (X-Forwarded-Proto/Host of the reverse proxy). If the proxy doesn't forward them correctly, pin it with CONFIG_API_PUBLIC_URL=https://<host> – see Configuration.

Errors return to the login page: not in an allowed group, took too long (more than 10 minutes in Authentik) or sign-in failed (details in the worker log).

Security

• The browser never holds an API token: sign-in sets an httpOnly, SameSite=Lax session cookie (Secure behind https), stored in Redis (in memory without Redis – sessions are then lost on restart).
• Requests that change data must carry the X-TIS-Client: web header, which other sites can't add – protection against cross-site request forgery.
• The API keeps accepting tokens as before; a token always wins over a session cookie.