Panoptes documentation

Start by connecting a dedicated cloud identity with read-only permissions. Panoptes periodically syncs supported resources, spend and findings into your workspace. Check the last sync time before making decisions; dashboard data is a snapshot rather than a continuous live feed.

What you can do

• Inventory — VMs, storage and Kubernetes workloads from every connected account in one filterable list.
• Cost — spend by provider and service, a six-month trend, a month-end forecast and anomaly detection.
• Savings — VMs to review for possible savings, right-sizing candidates and resources missing required tags.
• Security — public storage and sensitive ports open to the internet, ranked by severity.
• Terraform drift — resources created, removed or changed outside Terraform.
• AI Copilot — plain-English questions answered from your synced data.

1. 1
   Create an account

   Register at /register. A workspace is created for you. Open Plans to check your trial, current plan and limits. A Free account does not require a payment card.
2. 2
   Connect a cloud account

   Open Settings → Connected cloud accounts → Connect account, choose a provider and paste read-only credentials. They are tested before they are saved.
3. 3
   Run and verify the first sync

   Use Sync now for the account. Check its result and last successful sync. Duration varies with size, permissions and provider response times; a connection test is not a complete inventory or billing check.
4. 4
   Verify a known resource

   Open Virtual machines or Storage and compare one resource with the provider console. Review Overview → Needs attention next. Empty data does not establish complete coverage.

Cloud credential fields are encrypted with AES-256-GCM before storage and are excluded from normal customer responses and Copilot context. Enter them only in the connection form.

Permissions by provider

1. 1
   Prepare credentials

   Ask the cloud administrator for a dedicated identity with the required scope. Keep key files private; never use a root identity or a broadly privileged production administrator.
2. 2
   Enter the actual form fields

   In Settings → Connected cloud accounts → Connect account, choose a provider and label. For GCP paste the complete JSON key; for Azure use the secret value rather than its identifier.
3. 3
   Test the selected workflow

   Save after the connection check succeeds, run Sync now and compare a known resource. In the account row, open View collection details when Collection has gaps appears. Failed or incomplete inventory reads retain previous records, which may be stale. GCP billing needs the export table and location described below; review billing collection details separately. Test security and write workflows independently. Use re-authentication after credential rotation or expiry.

Google Cloud actual costs

1. 1
   Enable the export in Google Cloud

   In Billing → Billing export → BigQuery export, enable Standard usage cost or Detailed usage cost and select a dataset. Wait for Google to populate the export table. FOCUS exports are not supported by this importer.
2. 2
   Grant access to the Panoptes service account

   Enable the BigQuery API. Grant roles/bigquery.dataViewer on the export dataset/table and roles/bigquery.jobUser on the project that will run queries. Your administrator enables the export; Panoptes only reads it.
3. 3
   Add the export configuration

   In the GCP connection form, enter Billing export table as project.dataset.table and the exact Billing export location, such as US, EU or us-central1. The optional query project defaults to the table’s project. The connected Project ID selects whose charges are imported; a billing account ID is only an optional filter. Re-enter export fields when replacing credentials.
4. 4
   Sync and compare

   Select Sync now, inspect collection details, then open Cost analysis. Compare the same project, UTC usage month and after-credit costs with Google Billing. Repeated imports update the stored service/month totals. No results, permission errors and delayed exports are reported separately.

Optional write permissions

Start, stop and restart actions on VMs need extra permissions on the same credential. They are optional and never required for visibility.

ec2:StartInstances
ec2:StopInstances
ec2:RebootInstances

Product demos

For a guided product demo, contact our team. Any data labelled demo is illustrative and should not be used for billing or infrastructure decisions.

The web dashboard works without a CLI installation. If you prefer terminal workflows, install the official panoptes-cli package. You need Node.js 22 or newer, a Panoptes account and the appropriate plan and role.

1. 1
   Install the official client

   Install panoptes-cli with npm, then check the installed version using pnpt -v.
2. 2
   Sign in to Panoptes

   Run pnpt login. The client connects to the hosted Panoptes service and asks for your email and password. Password input is hidden. Google-only sign-in is not supported by this CLI; use the web dashboard for that account.
3. 3
   Check your workspace

   Run pnpt whoami and pnpt status, then start with read-only commands. Resource IDs come from Panoptes list output. Your subscription, team role and enabled two-factor checks also apply in the CLI.

npm install -g panoptes-cli
pnpt -v
pnpt login
pnpt whoami
pnpt status

pnpt vm list
pnpt aws vm list --region us-east-1
pnpt security findings --severity critical
pnpt approvals list
pnpt --help

Keep the CLI session files private and run pnpt logout on shared devices. Passwords are not saved by the client. If a write times out, check the dashboard and audit log before retrying; the operation may already have been accepted.

Report the screen, time, provider and sanitized error to panoptes.cloud@gmail.com. Remove passwords, keys, cookies, raw state and kubeconfigs.

The Virtual machines and Storage pages read from the synced snapshot. Filter by provider, status, region or tag, search by name or ID, and export the current view to CSV.

Freshness

The top bar always shows when data was last synced. Data older than the expected refresh window is marked stale, and its exact UTC timestamp is available on hover. Panoptes refreshes connected accounts periodically. Check the displayed sync time and use Sync now in Settings when you need a fresh observation.

VM actions

Users with write access can start, stop and restart VMs from the table, and set auto-stop schedules. Viewers see the data but cannot run actions. Actions are recorded in the audit log.

The Cost analysis page shows this month’s spend by provider with the change against last month, a six-month trend, spend by service for the current month and a month-end forecast with a confidence label.

Missing cost data

If a provider has no cost data yet, the console says so instead of showing $0, and totals state which providers they exclude. On Free, cost analytics is locked and shown as such.

Exports

Use Export CSV to download the figures on the page. For a shareable summary, see the Executive report.

When a sync returns fresh billing records without reported billing gaps, Panoptes compares the current month’s spend for every provider and service with the average of up to the three most recent complete months. If the increase is larger than the threshold, an anomaly is recorded.

• The standard anomaly threshold is an increase of 40% above the baseline.
• Baselines below $10 are ignored so a $2 to $6 change does not create noise.
• Anomalies appear in the Overview’s Needs attention list and on the Cost anomalies page.

Use the row controls to dismiss, mark implemented, snooze until a date, or accept risk with a reason. Snoozed recommendations can reopen when a later scan finds them after expiry. These states record review; they do not execute a cloud change.

1. 1
   Verify the evidence

   Compare the candidate with actual workload utilization, ownership and provider pricing. Static estimates can overlap; they are not verified or realized savings.
2. 2
   Record a decision

   Choose Snooze, Dismiss or Accept risk and complete the requested date/reason. A later scan can refresh its lifecycle.
3. 3
   Request an action

   Where offered, Request action creates an approval request: idle candidates map to stop and right-size candidates to resize. Review and execution are separate steps; inspect the request and provider permissions first.

Panoptes re-scans connected accounts on a schedule, and you can run a scan on demand with Scan now.

What is checked

Working with findings

Each finding shows the resource, what is wrong and a recommended fix. You can acknowledge it, resolve it and export the list. Findings that stop appearing in a scan are resolved automatically, and a problem that comes back re-opens its finding.

Upload a Terraform state file (version 4 JSON) for a cloud account. Panoptes extracts selected attributes and manually compares them with the stored inventory snapshot.

1. 1
   Refresh the source

   Sync the connected account successfully, then open Terraform drift/IaC Drift.
2. 2
   Upload a snapshot

   Select the account, name the source, then upload the local state JSON or paste it. Choose Upload state.
3. 3
   Run and verify a check

   Run the uploaded state's check control. Confirm any reported change in the provider console and Terraform before acting.

The raw state is encrypted at rest and never returned by the API. Drift findings can be exported. Panoptes reports drift only; apply fixes through your normal Terraform workflow.

Connect a cluster

1. 1
   Open Kubernetes

   Choose Connect cluster.
2. 2
   Add the cluster

   Enter a name, choose the provider and paste a kubeconfig. It is tested, encrypted and stored in the vault.
3. 3
   Browse your cluster

   Use the Clusters, Nodes and Pods tabs to inspect supported workloads. Deployment listing and scaling are also available in the CLI. Some additional cluster workflows are still in beta and do not have dashboard controls.

Pod actions

Users with write access can restart a pod and read its logs in the browser. Removing a cluster can require two-factor confirmation. Panoptes does not open shells in pods.

Scale a deployment

Use the CLI to list deployments and inspect the scale command before changing replica counts. Scaling changes your cluster and requires write access. Approval-based rollout restart/rollback is a newer beta workflow; contact support to check access for your workspace.

pnpt k8s deployments list CLUSTER_ID
pnpt k8s deployments scale --help

The Copilot answers using selected synced resources, spend and findings. It can miss context or make mistakes, so verify important answers in the dashboard and provider console. Connection credentials are excluded from its supplied context.

Example questions

• Which region costs the most this month?
• How many VMs are stopped across all providers?
• Which security findings are critical?

Budget alerts

An alert compares your current calendar-month spend, overall or for one provider, with a threshold. When spend crosses the limit the alert triggers once and appears in the dashboard banner. It resets when spend falls back under the threshold, and changing the threshold re-arms it immediately.

Slack and webhooks

On Pro and Enterprise, alerts can also be delivered to a Slack channel or to your own endpoint (Settings → Slack alerts and Webhooks).

• Webhooks carry an HMAC signature so the receiver can verify them.
• Failed deliveries are retried with increasing delays (1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours) and then marked as failed if delivery still cannot complete.
• Each delivery attempt is logged, and history is kept for 30 days.

Requests record an action, risk, reason and status: pending, approved, executing, completed, failed or rejected. An owner or admin other than the requester must approve. Owners, admins and members can execute an approved request; viewers cannot write. A solo owner needs another authorized teammate for independent approval. Pro access is required.

1. 1
   Create the request

   Use a recommendation's Request action control or the CLI. VM/storage requests bind to a synced resource in the selected account. An external ID or region that differs from the selected resource is rejected. Sync inventory first if the target is missing.
2. 2
   Read a preview

   Open Approvals and select Preview. Check target parameters and the provider-specific effect. Network remediation may delete a whole matching rule, affecting other ports/sources. Rollback guidance is descriptive, not automatic undo.
3. 3
   Obtain independent review

   Another owner/admin selects Approve or Reject / withdraw and optionally leaves a note. Approval saves the review; it does not execute. Members can withdraw their own pending request. Use status filters and page controls for older requests.
4. 4
   Execute separately

   Select Execute approved action and confirm the target. All approved actions, including VM start, require a fresh authenticator code when your 2FA is enabled. The server accepts one execution claim per request. Inspect evidence and sync inventory: provider acknowledgement does not prove a completed rollout or healthy workload.

pnpt approvals list
pnpt approvals approve --help
pnpt approvals execute --help

The Executive report page summarizes spend, selected security findings and drift for your organization. It is part of the Pro plan.

1. 1
   Review the report

   Open Executive report. Check the period, included providers and data freshness. Missing or stale source data also affects the report.
2. 2
   Export your summary

   Select Export Excel to download the spreadsheet. Share it only with people authorized to see your organization's cloud information.

Additional report options — beta

PDF export, scheduled email and expiring report links are newer beta workflows and are not yet available from the standard report controls or the public CLI release described above. Contact support to check availability and access for your workspace.

If scheduled delivery is enabled for your workspace, review its delivery history to confirm each send. If report sharing is enabled, an active link grants access to anyone who holds it. Share links currently return report data rather than a formatted report webpage; treat them as confidential and revoke them when no longer needed.

To invite someone, go to Settings → Team, enter their email and choose a role. Invitation and organization-membership checks determine access. Your plan determines how many team members you can add.

If an invitation email does not arrive, check spam and use the invitation-link option shown in Settings. Send that link only to the intended teammate. For an expired invitation or trouble joining an existing workspace, contact your workspace administrator or Panoptes support.

Your workspace groups connected accounts, reports and team permissions. Before changing infrastructure, confirm you are working in the intended workspace. Tabs in the same browser share the signed-in account.

Manage teammates in Settings → Team. Organization switching, ownership transfer and detailed session management are newer beta workflows that may not have self-service controls in your release; contact support for availability and assistance.

Sign-in security

Sign out on shared devices and use pnpt logout after a shared terminal session. Changing or resetting your password invalidates existing sessions; sign in again on each device. If you use Google-only sign-in or need help revoking access, contact support.

Two-factor authentication

Turn on authenticator-app (TOTP) two-factor authentication under Settings → Two-factor authentication. It adds a one-time code check to destructive actions such as removing a cloud account or cluster, deleting account data, and executing approved action requests.

Confirm enrollment with a code before 2FA becomes enabled. Each code is consumed once across enrollment, disabling 2FA and protected actions; wait for the next code after using one. If verification cannot be recorded, the protected action is blocked.

Passwords and sign-in

Change your password under Settings → Profile using your current password, then sign in again. A successful password change or reset signs out all existing sessions and invalidates outstanding reset links. Reset links are single-use, including simultaneous submissions. Sign-in is rate limited with account lockout, and requests that change data are checked for same-origin. If your session cannot be verified, sign in again or contact support.

Credential vault

Cloud credentials and kubeconfigs are encrypted at rest with AES-256-GCM and excluded from all API responses.

Audit log

Sensitive actions are recorded with who, what and when. Search, filter and export them from Audit log. The history you can view depends on your plan. This viewing window is separate from data-retention and deletion policies.

Eligible workspaces can receive a 14-day Pro trial; your Plans page shows whether a trial is active. See pricing for the full feature comparison. SSO/SAML for Enterprise is in development.