Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.xloud.tech/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

XIMP security encompasses agent authentication via per-node tokens, dashboard access control through Xloud identity roles, and TLS certificate lifecycle management for all platform communications.
Administrator Access Required — This operation requires the admin role. Contact your Xloud administrator if you do not have sufficient permissions.

​
Agent Authentication

Each XIMP agent authenticates to the collector using a unique per-node token. Rotate tokens periodically and immediately when a node is decommissioned or suspected compromised.
Generate a new agent token
ximp agent token create --node compute-node-04 --expires 365d
List all agent tokens with expiry
ximp agent token list
Revoke an agent token
ximp agent token revoke <TOKEN_ID>
Revoking a token immediately disconnects the associated agent. Ensure the replacement token is deployed to the agent configuration before revoking the old one, or the node will stop reporting metrics.

​
Dashboard Access Control

XIMP dashboard access is controlled through Xloud identity roles. Assign roles based on job function to enforce least-privilege access.
RoleAccess LevelTypical Assignees
monitoring-viewerRead-only — dashboards and alert historyDevelopers, stakeholders
monitoring-editorCreate and edit dashboards, rules, and channelsOperations engineers
monitoring-adminFull access — agents, retention, security settingsPlatform administrators
Assign roles through XDeploy → Identity → Role Assignments.
Use the monitoring-viewer role for application teams who need to observe their service metrics without the ability to modify alert rules that affect other teams.

​
TLS Configuration

All XIMP communication uses TLS:
  • Agent-to-collector: TLS 1.3 minimum
  • Dashboard and API: TLS 1.3 minimum, HSTS enabled
  • Internal service communication: mTLS for collector-to-store traffic
Certificates are managed by XDeploy and renewed automatically 30 days before expiry.
Check all certificate expiry dates
ximp tls status
Expected output shows certificate subjects, expiry dates, and days remaining. Certificates within 30 days of expiry trigger an automatic renewal.

​
Next Steps

Agent Configuration

Deploy and configure agents whose tokens are managed here

Alert Channels

Secure notification channel credentials and SMTP authentication

Troubleshooting

Diagnose TLS and authentication errors

Xloud Identity

Manage the Xloud identity roles used for XIMP access control