A token leaked — what to do
Each collector has its own token, scoped to that one box. If a collector is compromised, lost, or you can no longer reach it, you don't need to disturb the rest of the fleet — revoke just that collector.
Revoke one collector
On Collectors, open the collector and Revoke it (or use Bulk revoke offline to clear several dead ones at once). Revocation is immediate: that collector's token stops working for ingest and status right away, and it can't inspect traffic anymore.
To bring a replacement online, add a fresh collector (Collectors → Add collector) and run the installer on the host — see Install a collector. The new box enrolls with its own token and lands in pending approval.
What's not affected
Revoking a collector leaves your policy rules, identity mappings, and audit history untouched — they live in the cloud, not on the collector.
The workspace API token leaked
The workspace API token (used by scripts, SDKs, connectors and the host sensor) is separate from collector tokens. Rotate it yourself:
- API Access → API token → Rotate token (tenant_admin only).
- Tick only the scopes the integration needs —
read,policy,connector. Ticking nothing gives full workspace access. - Copy the new token — it's shown once. The old token stops working immediately.
- Update every CLI, SDK, connector and host sensor (
KILASEC_TOKEN) that used it.
The rotation is recorded on Logs. See API Access & Connect Claude for what each scope covers.
For a leaked Connect Claude key, revoke it under API Access → Connect Claude → Active keys, or Disconnect the assistant under Connected. Both take effect on the next call.
Bigger compromise
If you believe your whole workspace is compromised (not just one collector or token), contact Kilasec so a fleet-wide re-enrollment can be coordinated without a silent outage.
→ For a collector that's merely unreachable rather than compromised, start with Collector is offline.