Best practices

These recommendations help an administrator keep an organisation safe. Each one uses a setting that livewells offers.

Turn on "Assignment required" on the livewells enterprise application in Entra and assign your people to it.
Enable the rule Roles come from Entra. livewells then lets in only a person who holds a livewells app role.
Enable the rule Multi-factor sign-in. livewells then lets in only a person whose sign-in used more than one factor.
Choose a sign-in length from 1 to 8 hours that fits your policy.
Name a second administrator before an administrator leaves. livewells refuses to remove or demote the last administrator.

API keys and webhooks

Choose the lowest access that the script needs: Read only, Read and send links and files, Download samples only, or Queue links only (browser extension).
Limit each key to the IP ranges of the system that uses it.
Choose a short validity for a key. A queue key is valid for 1 to 72 hours. Another key is valid for 30 to 365 days.
Revoke a key when its owner leaves.
Check the signature of each webhook call and reject old timestamps. See API.
Read the delivery log to see the state, the attempts and the last status of each delivery.

Set the shortest retention that your policy allows. The range is 7 to 365 days.
Switch sample downloads off when your analysts do not need the original files of a case.
Exclude cases from threat data when your policy asks for it.
Export the audit log to keep a copy in your own systems.

Name up to 5 alert addresses, so that the right people get the start limit alerts.
Lower the start limit when a script starts too many sessions.
Read Usage to see your submissions and your stored files against their limits, and your network traffic from 80% of its limit.