Frequently Asked Questions

Anaphora is an automation tool for reporting and alerting. It allows you to:

• Capture screenshots and raw values from Kibana, Grafana, Metabase and any authenticated web app
• Let an AI reason about all of them together and decide whether a human needs to know (optional)
• Compose branded PDF reports with the drag-and-drop composer
• Deliver reports and alerts through email, Slack, webhooks and S3

Local users with a password work in every edition. The Enterprise edition adds single sign-on:

• LDAP - Active Directory, OpenLDAP, LemonLDAP, and more
• SAML SSO - Microsoft ADFS, Azure AD, Keycloak, and others
• OIDC - OpenID Connect, Google, Auth0, and similar providers. Set it in the settings page, or from the environment with OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET

Password guessing is limited: after 10 failures for one user name from one address in 15 minutes, Anaphora refuses that user name from that address until the window ends.

A space holds jobs, runs, reports, templates, delivery interfaces and AI providers, and keeps them apart from the other spaces. Each space gives a user or a role one of three access levels:

• Read Only - sees the jobs, the runs and the reports
• Read Write - also creates, edits and runs jobs
• Admin - also manages the templates, the delivery interfaces and the AI providers

The system role manages the settings, the users, the spaces, and the export and import of the whole instance. With single sign-on, the groups that the identity provider sends become the roles of the user. In the Free edition every account has the admin and the system role; PRO and Enterprise give each user the roles you assign.

Yes. A user who signs in with OIDC, SAML or LDAP gets the system role, and with it the Settings menu, when one of their groups is in the system groups of that sign-in method.

• For OIDC from the environment, list the groups in OIDC_SYSTEM_GROUPS
• Otherwise, use System groups in the section of the method in the settings

Names match whole and with case, so use a name that is unique at the provider: an LDAP group DN, a Keycloak realm role or a full group path. A change applies at the next request of the user. Keep a local system user: it is the way in when the provider is down.

Anaphora offers flexible scheduling options:

• User-friendly interface for setting up intervals
• Advanced CRON scheduling for precise timing control
• Custom scheduling based on your specific needs

Anaphora supports multiple delivery channels including:

• Email notifications with customizable templates
• Slack integration for real-time updates
• Custom webhooks for platforms like Telegram, Discord, Mattermost
• Direct S3 upload for secure storage

Yes! Our intuitive drag-and-drop PDF report composer allows you to:

• Design professional reports with a modern layout
• Combine screenshots, text, and graphics seamlessly
• Create pixel-perfect A4 PDF documents
• Save templates for consistent reporting

No. The AI step is optional. Reports, scheduled captures, thresholds, anomaly rules and alerts all work without any AI provider. Add a provider only when you want a job to reason about what it captured. A job that has no AI action never sends anything to a model.

You bring your own provider. Anaphora talks to any service that implements the OpenAI-compatible API: OpenAI, DeepSeek, and via a custom endpoint also Claude, Grok, Qwen, Llama or a self-hosted vLLM server. You enter the endpoint, the API key (stored encrypted) and the model, press Test, and save. Each Space can have its own providers. A provider can also come from environment variables: Anaphora creates it at the first start and keeps it in line with them at every start. The Free edition allows one provider per Space, PRO and Enterprise are unlimited.

The AI action receives every earlier snapshot of the run as its accessibility tree, the text structure of the page, plus every captured variable. With a vision-capable model you can also send the snapshots as images, so the model reads the charts the way a person does: trends, spikes, colours, panel titles. This is where the cross-source reasoning happens, because a Kibana error panel, a Grafana latency graph and a Metabase order count all arrive in the same context. For best results use a model that reads images; with a text-only model the AI still gets the numbers and the page text, but not the picture. You control the context: send everything so far, or tick only the rows the prompt needs.

Yes. The AI action writes its answer into a variable, as text, HTML or a number. Ask for a severity score, or a 0/1 verdict, and put that number in a conditional block with a Break: when the AI says there is nothing to act on, the run stops and nobody is notified. The answer must be a bare number, or hold exactly one number, such as “Severity: 7” or “7/10”. Any other answer fails the run, so a branch never runs on an answer nobody can read. When it does matter, the AI text goes into the Slack message, the email or the PDF next to the screenshots, so the person who is paged also gets the explanation.

The built-in Kibana AI Triage template is a ready example: it rates the severity from 0 to 10, stops below 7, and at 7 and above a second AI action writes the briefing that goes with the report. The template needs the PRO or Enterprise edition.

Every provider shows the tokens it spent in the last 24 hours and the last 7 days, and you can set a daily and a weekly budget on each. When a budget is reached the job that made the call is paused, further calls on that provider are refused until the window rolls over, and the operator can get an alert, with an early warning at 80% by default. You resume the paused jobs with one click. Per action, an answer length cap limits the reply and the ticked-rows mode sends less context, so a big dashboard does not cost a full page of tokens every run.

Open Application Settings → Health Monitoring. Choose the delivery interface for operator notifications and switch on Job Health Alerts. Anaphora checks the jobs as often as you set, and sends an alert when the success rate of a job changes, at most as often as you allow.

Each job and delivery interface is green, yellow or red from its recent runs, and gray when it has no recent runs. The same channel carries the AI token budget alerts.

Yes, from /guest/api/health. Without credentials it answers with the worst status, the counts per colour and one status per job and delivery interface, with no names.

For the full listing, create an observer key under Application Settings → API Keys, and send it in the header Authorization: Bearer <key>. The monitor then reads every job and delivery interface by name, with its schedule, its recent runs and the delivery counts of the last 24 hours. Error texts stay out, because they can quote captured data.

• The key is shown once, with a ready curl command to test it. Anaphora keeps only a hash
• The list shows when each key was last used, and revokes a key
• A revoked or mistyped key gets 401, so the monitor raises an alert instead of reading the anonymous answer
• A key in the query string is not read, because query strings end up in proxy logs