Predict! Risk Controller: System Settings Guide

Title

Answer

System Settings Guide

Overview

The System Settings page in Predict! Risk Controller contains system-wide configuration options that apply to all users, regardless of their role permissions or layout settings. This article covers:

Access requirements — the permissions needed to view and modify settings
Location — where the Settings page can be found in the application
Configuration — how to edit, revert, and audit settings
Functionality — what each of the 31 settings controls within the application

Access Requirements

The Settings page is accessible to users with administrator privileges.

By default, the ADMIN account has access.

Contact the Predict! administrator to request access or to have changes applied on behalf of the organisation.

Location

Log in to Predict! Risk Controller as an administrator.
From the top navigation bar, open the Admin Portal (the cog icon).
Navigate to Settings in the left-hand menu.
The Settings page displays all system settings as key–value pairs.

Configuration

Edit a Setting

Locate the setting in the list and click the pencil (edit) icon in that row.
Modify the Value field as required.
Click the save icon to commit the change.

Revert a Setting to Default

Click the reset icon on the setting row to restore the setting to its out-of-the-box default value.

View Change History

Two methods are available for reviewing change history:

Last Changed summary
1. The Last Changed date/time and the Changed By username are displayed at the bottom of the Settings page.
2. This reflects the most recently edited setting.
Full audit export
1. Click the export button in the page header to download a complete audit trail of all changes to Excel.
2. Filter by the Key column to view changes for a specific setting over time.

Note:

In some instances, Unknown User may appear under Changed By.

This occurs when:

the last edit was made by the installer
an update script
a version of Risk Controller that did not track the user making changes.

No action is required.

System Settings Reference

A new installation of Risk Controller 6.5.0 and later will contain all settings below with appropriate defaults. Earlier versions may contain a subset; missing settings can be introduced manually.

Setting Key	Accepted Values	Default	Description
actions.visible	true / false	true	Determines whether actions will be used. When set to false, users cannot see or create actions.
admin_rows_per_page	Number	10,000	Controls the number of items visible at once on admin pages. When the value is smaller than the total items, a paginator appears.
cluster.server / cluster.server.[1-9]	ip:port:ssl	(blank)	Used when load balancing is configured, to allow changes on one server to automatically refresh lists on other servers. Format: ip:port:ssl (e.g. 192.168.2.99:8080:false).
connect_cache_max_age	Seconds	3600	Controls how long responses are cached when using the Predict! Connect API. The default is 3600 seconds (one hour).
controls.visible	true / false	true	Determines whether controls will be used. When set to false, users cannot see or create controls.
date_pattern	Java SimpleDateFormat	(system locale)	Backup standard format for dates displayed throughout the product. Only used where Predict! cannot determine a user's browser or system locale.
display_factored_mean	true / false	false	When true, shows probability × mean (factored mean) in risk assessment accordions for quantitative impacts, instead of the plain mean.
display_most_likely_values	true / false	false	When true, shows the most likely value in risk assessment accordions for quantitative impacts. Overrides display_factored_mean. No value is shown if the distribution has no most likely value (e.g. Uniform).
force_two_factor_authentication	0 / 1 / 2	0	0 = disabled; 1 = optional (user controlled via My Profile); 2 = mandatory for all users.
issues.visible	true / false	true	Determines whether issues will be used as a risk type. When set to false, users cannot see any issues.
min_digits	Number	1	Minimum number of numeric characters required in user passwords. Set to 0 to not enforce.
min_pwd_length	Number	10	Minimum password length for user profiles. Set to 0 to not enforce.
min_lower_case	Number	1	Minimum number of lowercase characters required in user passwords. Set to 0 to not enforce.
min_symbols	Number	1	Minimum number of special characters required in user passwords. Set to 0 to not enforce.
min_upper_case	Number	1	Minimum number of uppercase characters required in user passwords. Set to 0 to not enforce.
oidc_enabled	true / false	false	Set to true when OIDC login has been configured. Controls the appearance of the Log in with Microsoft option on the Login page.
opportunities.visible	true / false	true	Determines whether opportunities will be used as a risk type. When set to false, users cannot create or see any opportunities.
private_domain	Domain string	(blank)	Allows use of a custom or private domain when the user login name is an email address. The value must be the domain to use.
proxy_ips / proxy_ips[1-3]	IP addresses (colon-separated)	(blank)	Specifies equivalent gateway or proxy addresses when using an external reverse proxy. Used by Predict! Risk Analyser and Risk Reporter to automatically authenticate tokens.
prv_show_ids	true / false	false	Controls whether the Predict! Risk Visualiser displays risk IDs alongside risk names (e.g. T12: Groundworks flood) or just the risk name.
prv_show_unitary_categories	true / false	false	Controls whether the Predict! Risk Visualiser displays a category group boundary around a single risk node.
saml_logout	URL	(blank)	Used when Risk Controller is configured with SSO via SAML. Must be set to the identity provider's global logout URL to release licences on logout or session timeout.
search_type	prefix / advancedkeyword / wildcard	prefix	Controls search behaviour. prefix: matches items starting with the term. keyword: exact match only. wildcard: use ? for a single unknown character, * for any sequence.
server_port_prc6	Port number	(installation port)	Used by Predict!'s search module to access the database. Must match the port used to access Risk Controller.
server-url	URL	(blank)	Used by reports containing hyperlinks and by the @RISK Cost Risk Analysis export. Required for the @RISK connection and cannot be left blank.
show_escalation_message	true / false	false	Displays a warning to users to consider escalating a risk when a risk assessment falls into the top-most rating band of its scoring system.
sort_tree_by_name	true / false	false	Controls folder tree order. When true, folders are sorted alphabetically. When false, folders are displayed in ID (creation) order.
threats.visible	true / false	true	Determines whether threats will be used as a risk type. When set to false, users cannot create or see any threats.
time.zone	Java timezone ID	Europe/London	Used when SAML authentication is configured. Sets the default server locale/timezone, which SAML bypasses via the normal browser cookie.
time_out	Minutes (> 2)	90	Controls how long Risk Controller sessions remain open with no activity before timing out. The value must be greater than 2 minutes.
Using_Active_Directory	true / false	false	When true, password fields disappear from user profiles. Must be set to true to upload users from LDAP via Data Upload.

Best Practices

Password Complexity Settings

The five password complexity settings (min_digits, min_pwd_length, min_lower_case, min_symbols, min_upper_case) work together to enforce a password policy for all local Predict! user accounts. Set any value to 0 to remove that specific constraint.

The minimum recommended password length is 10 characters (the default).
Where Active Directory authentication is in use, local password complexity settings still apply to any accounts not authenticated via AD. Consider setting Using_Active_Directory to true to suppress local password management entirely.

Risk Type Visibility Settings

The settings threats.visible, opportunities.visible, issues.visible, actions.visible, and controls.visible provide a fast way to simplify the interface for organisations that do not use all risk types. When a type is hidden:

Existing records are not deleted — they are hidden from view.
Setting the value back to true immediately restores visibility.
Communicate changes to users in advance, as items will disappear from their screens without warning.

Search Configuration

Choose search_type based on how users are likely to search:

prefix (default) — fastest and most intuitive. Matches anything starting with the typed term.
wildcard — most flexible. Use ? for a single unknown character and * for any character sequence.
keyword — strictest. Returns exact matches only. Useful for controlled vocabularies.

Session Timeout

The time_out value must always be greater than 2 minutes. For security-conscious deployments, 30–60 minutes is common. For always-on dashboard use cases, a higher value may be appropriate. The setting can be changed at any time via the Admin Portal Settings page.

Load Balancing Cluster Settings

When using Apache load balancing across multiple Predict! servers, configure cluster.server and cluster.server.[1-9] so that UI updates on one node propagate to all other nodes in real time. The format is ip:port:ssl (e.g. 192.168.2.99:8080:false). One entry is required per load-balanced server.

SSO and SAML Settings

When SAML-based single sign-on is configured, ensure the following are set correctly:

saml_logout — without this, licences may not be released properly on logout or session expiry.
time.zone — without this, all users will see dates and times in Europe/London. Set to the appropriate Java timezone ID for the organisation (e.g. America/New York or Australia/Sydney).
oidc_enabled — set to true after completing the OIDC/Azure AD setup to surface the Log in with Microsoft button on the login page.

Troubleshooting

Problem	Suggested Resolution
A setting change does not appear to take effect	Some settings (e.g. time_out, oidc_enabled, Using_Active_Directory) require a service restart to take full effect. Restart the Predict! Risk Controller service and re-test.
Changed By shows Unknown User	Expected behaviour when the last edit was made by the installer, an update script, or an older version of Risk Controller. No action is required.
Password complexity settings are not enforced	Confirm Using_Active_Directory is not set to true, as this suppresses local password management. Also verify that the min_* values are not set to 0.
Folders appear in the wrong order in the folder tree	Check the sort_tree_by_name setting. Set to true for alphabetical order or false for creation (ID) order.
Risk Analyser or Reporter users must authenticate manually despite tokens being configured	Configure proxy_ips and proxy_ips[1-3] with the gateway or proxy IP addresses used by the reverse proxy server.
The Log in with Microsoft button is not appearing on the login screen	Ensure oidc_enabled is set to true and that the OIDC configuration has been completed in standalone.xml. Refer to the OIDC/SSO Configuration article for full setup steps.
Risks in the Risk Visualiser are not showing IDs	Set prv_show_ids to true in the Settings page. Refresh the Predict! Risk Visualiser after saving.
@RISK Cost Risk Analysis export is not working	The server-url setting must be configured with the correct URL for Risk Controller. This setting cannot be left blank for the @RISK connection to function.

URL Name

Predict-Risk-Controller-System-Settings-Guide

Predict! Risk Controller: System Settings Guide

Information

Related Articles

Trending Articles