Workspaces
Investigate data that stays on your hosts: on-site agents run the analysis where the data is, and mlab.sh only sees the answers.
A workspace lets your analysts investigate data that never leaves your hosts. An on-site agent (mlab-agent) runs next to the data, connects out to mlab.sh, and runs the tools its local policy allows. The first tool is engram, memory forensics: a memory dump stays on the host, engram analyses it there, and your team explores the result in mlab.sh.
Workspaces are available on the Team (1 workspace) and Enterprise (20 workspaces) plans. On other plans, Organization › Workspaces shows what they do and how to get them.
How it works
Create a workspace in Organization › Workspaces, and choose which members may open it.
Enrol an agent on the host that holds the data, with a one-time code from the workspace's Agents tab. See The agent.
Write its local policy on the host: which tools run, which folders they may read, which operations they may serve. mlab.sh helps you write it but never pushes it.
Investigate: list the dumps on the host, index one, then explore it in the browser. See Memory forensics.
The agent never accepts incoming connections, and mlab.sh never connects to your network. Every request is signed, end-to-end encrypted, checked against the local policy and written to an audit log on the host. See Security and data.
Who can do what
| Owner, Admin | Other members | |
|---|---|---|
| See a workspace | all of them | only the ones they were added to |
| Create, rename, delete, choose members | yes | no |
| Enrol or revoke an agent | yes | no |
| Test an agent, see its tools, investigate | yes | yes, in their workspaces |
| Delete a stored index | yes | no |
Every action is in the organization audit log, under Workspaces, and can be sent to your webhooks.
The workspace page
| Tab | What you find there |
|---|---|
| Overview | Agents online, tools running, this month's requests, the mlab.sh key fingerprint to check at enrolment. |
| Agents | Each agent's live state and tools, Test (a signed round trip), Policy (the policy editor), Revoke, and Enrol an agent. |
| Tools | A matrix of tools and agents: the version each agent runs, whether it is up to date, install and update commands. |
| Memory | The dumps your agents can see, their indexes, and the memory explorer. |
| Members | Who may open the workspace. |
| Consumption | Requests per month, all tools together and per tool. |
| Settings | Name, description, icon and color, the data holding period, and deletion. |
Deleting a workspace revokes every agent first and deletes everything mlab.sh held for it.