Your own account — username, email, avatar, theme, password and two-factor authentication — plus a read-only view of the role and workspaces you can reach.
What it is
/profile is every user's own account page, open to all roles — reach it from Settings → Profile or from the account menu at the foot of the sidebar. It splits in two: the identity and preferences you control, and a read-only view of the access an admin has granted you. Your global role is shown as a badge beside the page title.
What you can edit
Username
Your login handle, 1–120 characters and unique — you sign in with it or your email. Signing in through SSO never changes it.
Email
Must be unique. A credentials account confirms the change with its current password.
Avatar
Upload photo takes a PNG, JPEG, GIF or WebP up to 5 MB and stores it as a 512 × 512 WebP. Without one the Talon mark is shown. An SSO sign-in fills the avatar from your provider only when you have none, so an upload always wins.
Default theme
System, Dark or Light. It applies immediately and follows your account to every sign-in.
Password
Credentials accounts only. At least 12 characters with an upper-case letter, a lower-case letter, a number and a symbol, and different from the current one; you confirm with your current password.
These are read-only here — an admin sets them from Settings → Users & teams (/settings/users):
Global role — admin, engineer, analyst or readonly.
Sign-in method — credentials, or the SSO provider. Each SSO identity linked to your account appears under Account security as GitHub, Google or Microsoft single sign-on, marked Connected.
Workspace access — a table of each workspace you can reach, its SIEM, your role there (viewer / engineer / owner) and how you got it: a direct grant, a team, or being an org admin (admins are owner of every workspace).
Display name — for an SSO-linked account, the name your identity provider sends. It is re-synced at every SSO sign-in and shown on your profile in place of your username.
Settings → Profile
The profile page. The identity rail on the left carries your avatar, sign-in method, two-factor status and Default theme; the Identity panel beside it edits Username and Email.
Security & access
The Account security panel is where a credentials user enrols an authenticator app (TOTP, RFC 6238: six digits every 30 seconds; the secret is stored encrypted). Setup shows a QR code, with the setup key and URI to copy if you can't scan it, and you confirm with a code from the app. Below it, Workspace access lists what you can reach. Account activity shows your 20 most recent audit events — things you did and things done to your account, such as sign-ins and security changes — and expands each one to its IP address, device and details. Contribution activity is a year-long heatmap of your detection commits.
Recovery codes. Enrolling issues ten single-use recovery codes of eight characters — shown once, stored only as bcrypt hashes — so a lost authenticator doesn't lock you out. Each works exactly once at sign-in in place of a TOTP code. Save them before closing the dialog; they can't be shown again.
You can turn your own two-factor authentication off here too: click the enabled Authenticator app row and enter a current code.
Codes tolerate a little clock drift: a code from one 30-second step before or after the current one still verifies.
If an admin has turned on Require two-factor authentication, a credentials user who hasn't enrolled is sent to this page, with a banner, until they do.
An account created with a temporary password is sent to a change-password page after sign-in and can't use the app until the password is changed.
Tip
If you're a credentials user, enrol an authenticator here and save the recovery codes somewhere other than the device the app runs on. SSO users don't enrol here — the panel reads "SSO accounts inherit 2FA policy from the identity provider", and there is no password row, because both belong to the provider.