Your first investigation

Choose the system you want to ask about, then follow eight steps from installing Verbiqo to a first answer you can check. Allow about half an hour, plus any time waiting for an administrator.

Choose your source

The steps below show what to do for: PostgreSQL MySQL SQL Server Redis Elasticsearch or OpenSearch Kubernetes Prometheus or Thanos Splunk

Each step says where to go, what you supply, what success looks like, and whether you need an administrator. Open If it fails under a step only when you need it.

Before you start

A Mac with macOS 13 or later. On Windows the beta is given out on request, and the menu is by the clock instead of in the menu bar.
An AI model you are allowed to send your systems’ metadata to: where your model comes from.
Someone who can create a read-only account on the system, if that is not you.

1. Install Verbiqo

Where: The download section of verbiqo.app. Open the downloaded file, drag Verbiqo to Applications, then open it.
You supply: The right download: Apple Silicon for M-series Macs, Intel for older ones.
Success: The Verbiqo icon appears in the menu bar. There is no main window.
Administrator: Only if your Mac does not let you install apps.

If it fails

If macOS will not open it, check it came from verbiqo.app: the app is signed and notarized by Apple. Install details.

2. Set up a model that can investigate

Where: Menu bar icon › Settings… › AI provider, then Test & Load Models, Model and Save.
You supply: Your organization’s endpoint, an approved cloud API, or a model on this computer (which to choose), and Context window 32768, Timeout (ms) 300000, Temperature 0.2.
Success: Test & Load Models lists your models. Then, in Terminal, /Applications/Verbiqo.app/Contents/Helpers/verbiqo model-check reports Fit for Verbiqo. It uses built-in test data and connects to nothing but the model.
Administrator: For your organization’s endpoint details, if you use one.

If it fails

Not fit as configured lists what to change. The models that passed are in Tested models. An unavailable model is usually the endpoint, the key or a certificate: Troubleshooting.

3. Get a read-only account

PostgreSQL

What it is: A login role that is not a superuser, granted pg_monitor, and a pg_hba.conf line on every node that lets it connect. It reads activity, statistics and settings, and nothing in your tables.
Where: The commands are in Set up PostgreSQL.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: a database administrator creates the role and edits pg_hba.conf.

MySQL

What it is: A monitoring account with PROCESS and REPLICATION CLIENT, and reads in performance_schema and sys. Nothing in your schemas.
Where: The commands are in Set up MySQL.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: someone who can create accounts and grant privileges.

SQL Server

What it is: A login with VIEW SERVER STATE and VIEW ANY DEFINITION, and SHOWPLAN for its user in master.
Where: The commands are in Set up SQL Server.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: a database administrator creates the login.

Redis

What it is: An ACL user with no keys and no channels, and a few server-level read commands. Create it on every server, because ACL users are not copied.
Where: The commands are in Set up Redis.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: whoever administers the Redis servers.

Elasticsearch or OpenSearch

What it is: Elasticsearch: a monitoring role with an API key made from it. OpenSearch: a monitoring role mapped to a user or directory account. Cluster questions read health, statistics and index metadata rather than documents; security-log access is separate.
Where: The commands are under Elasticsearch role and OpenSearch role.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: someone who can create the monitoring role and credential.

Kubernetes

What it is: A ClusterRole that can only get and list, bound to a service account. Reading pod logs is optional. An administrator’s kubeconfig is refused.
Where: The commands are in Set up Kubernetes.
Success: The account exists and can sign in, with only those rights.
Administrator: Yes: creating the role and binding needs a cluster administrator.

Prometheus or Thanos

What it is: Prometheus has no roles. If a token or proxy sits in front, it must allow reads of the query, series, label values, metadata and build information endpoints.
Where: The commands are in Set up Prometheus or Thanos.
Success: The account exists and can sign in, with only those rights.
Administrator: Only if a token or proxy controls access.

Splunk

What it is: A role with the search capability, your log indexes in srchIndexesAllowed, and read on the app it searches in.
Where: The commands are in Set up Splunk.
Success: The account exists and can sign in, with only those rights.
Administrator: Usually yes: a Splunk administrator creates the role.

4. Add the connection and test it

First, in Settings, tick Let Verbiqo read databases and other systems.

PostgreSQL

Where: Menu bar icon › Extensions… › PostgreSQL.
You supply: A name you will type later (for example orders), host, port 5432, database, user verbiqo, the password, and TLS: Verify full with your CA certificate, or Require until you have it.
Success: Test Connection shows Connected., then the version, primary or standby, sessions in use and the TLS in use. Press Save Connection.
Administrator: Only for network access or pg_hba.conf.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

MySQL

Where: Menu bar icon › Extensions… › MySQL.
You supply: A name (for example shop), host, port 3306, user, password, and TLS: Verify identity with your CA certificate, or Required for MySQL’s own self-signed certificate.
Success: Test Connection shows Connected., then the product, version, role (source, replica or group member) and the TLS in use. Press Save Connection.
Administrator: Only for network access.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

SQL Server

Where: Menu bar icon › Extensions… › SQL Server.
You supply: A name (for example sales), host, port 1433 or the instance name, login, password, and encryption: Mandatory with Trust server certificate for the server’s own certificate, or Mandatory with your CA certificate.
Success: Test Connection shows Connected., then the product, version, edition, sessions and the encryption in use. Press Save Connection.
Administrator: Only for network access.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

Redis

Where: Menu bar icon › Extensions… › Redis.
You supply: A name (for example cache), host, port 6379, user verbiqo_monitor, password, and TLS: Disable for the plain port, or Verify full with the CA on the TLS port.
Success: Test Connection shows Connected., then the product, version, role, clients, keys and the TLS in use. Press Save Connection.
Administrator: Only for network access.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

Elasticsearch or OpenSearch

Where: Menu bar icon › Extensions… › Elasticsearch.
You supply: A name (for example logs), the URL such as https://host:9200, the API key (or a user and password), and the CA certificate if the cluster uses your organization’s own.
Success: Test Connection shows Connected., then the product and version, the cluster name, health, nodes and shards, and that the account cannot write or administer. Press Save Connection.
Administrator: Only for network access.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

Kubernetes

Where: Menu bar icon › Extensions… › Kubernetes.
You supply: A name (for example prod), and a kubeconfig context or a service-account token with the cluster’s CA certificate. Turn on Read pod logs only if the role allows it.
Success: Test Connection shows Connected., then the platform, version, node count and account, and what the account reads: the whole cluster or some namespaces, and whether logs are allowed. Press Save Connection.
Administrator: Only for VPN access to a private cluster.

If it fails

The test says what to fix: a password, a host that cannot be reached, a certificate, or an account refused because it could write or administer. Common errors · Connection problems.

Prometheus or Thanos

Where: Menu bar icon › Extensions… › Prometheus.
You supply: A name (for example prod), the URL, a token if needed, and whether it is Prometheus or a Thanos Querier. Press Save Connection, then Test Connection. Build the map before asking: without an embedding service, enter the technologies you need (for example mysql, node) under Refresh technology and press Refresh. With an embedding service configured, Build Index maps the whole estate. Both paths.
Success: Test Connection shows Connected., then the backend, version and number of series. The refresh or index build completes for the jobs you will investigate.
Administrator: Only for network access.

If it fails

The test says what to fix: an unreachable endpoint, a certificate, rejected credentials or missing read access. Use the source’s least-privilege access instructions; this test does not certify every account capability. Common errors · Connection problems.

Splunk

Where: Menu bar icon › Extensions… › Splunk.
You supply: A name (for example prod), the management URL such as https://host:8089, and a token (or a user and password).
Success: Test Connection shows Connected., then the server name, Splunk version, the account’s roles and how many indexes it can read. Press Save Connection.
Administrator: Only for access to the management port.

If it fails