docs(accessanalyzer): add external analytics store access page for 26.1

[markis]

Summary

• Adds integrations/external-clickhouse-access.md (26.1): how customers open the analytics store (ClickHouse) native/HTTP ports with dspmctl set-helm-param, including NodePort vs LoadBalancer, verification, limitations, and closing access.
• Links the page from the Integrations index and adds 9000/8123 to the inbound ports table in Requirements.

Documents the clickhouse.externalAccess Helm values added in netwrix-corp/access-analyzer PR #999 (AA-970).

Open items

• The LoadBalancer loadBalancerSourceRanges[0]=… syntax through dspmctl is untested on a live cluster.
• Does not say how customers obtain ClickHouse credentials.
• 26.1 only; 12.0 and 11.6 are unchanged.

Generated with AI

Co-Authored-By: Claude Code ai@netwrix.com

[github-actions]

Auto-Fix Summary

2 issues fixed, 4 skipped across 3 files

Category	Fixes
OxfordComma (rewrite)	1
Dale: passive-voice	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md:50 — Dale: misplaced-modifiers | "For LoadBalancer, restricted to one address range:" is a label fragment introducing a code block with no subject to misattach to; the meaning is unambiguous and every rewrite either adds a reduced passive or shifts the meaning |
| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: passive-voice | "the data that size is designed to hold" has no clear agent to promote; an active rewrite would change the meaning of the sizing guidance |
| docs/accessanalyzer/26.1/install/requirements.md:88 — Dale: passive-voice | "warns if a connection times out or is refused" would need an invented agent (host, firewall, or server) to become active, and the correct one is ambiguous |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | "at your own risk" is standard technical and legal phrasing rather than a culturally specific idiom |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

3 issues fixed, 6 skipped across 3 files

Category	Fixes
Dale: misplaced-modifiers	2
Dale: wordiness	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/install/requirements.md:88 — Dale: passive-voice | "warns if a connection times out or is refused" — the agent that refuses the connection is ambiguous (remote host vs. an intermediate firewall), so naming a subject could make the statement inaccurate. |
| docs/accessanalyzer/26.1/install/requirements.md:33 — Dale: passive-voice | "a virtual machine provisioned at exactly the stated figure" — reduced relative clause functioning as an adjective; supplying an agent would assert who provisions the VM, which the source doesn't state. |
| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: passive-voice | "the data that size is designed to hold" — established phrasing for product design intent; every active rewrite tested shifted the meaning of the sizing guidance. |
| docs/accessanalyzer/26.1/install/requirements.md:7 — Dale: idioms | "a few minutes here saves a failed installation later" — figurative but not culturally specific, and it reads literally enough for a non-native audience. |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | "continue at your own risk" — standard technical phrasing that mirrors the installer's own warning wording. |
| docs/accessanalyzer/26.1/integrations/index.md:8 — Dale: misplaced-modifiers | "the Activity tab of the Share Audit report in [Data reports]" — the prepositional phrase could attach to either report, but both live in Data reports, so either reading is correct and no rewrite is clearly better. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

3 issues fixed, 4 skipped across 3 files

Category	Fixes
Dale: passive-voice	3

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md:52 — Dale: misplaced-modifiers | "For LoadBalancer, restricting access to one address range:" is a sentence fragment labeling a code block, parallel to "For NodePort:" above it. No subject for the participle to attach to, and rewriting would break the parallel structure — multiple valid interpretations. |
| docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md:88 — Dale: wordiness | "the same per-query memory limits as the user Access Analyzer's own reports use" reads densely, but any tightening risks changing which user the limits are compared against. |
| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: passive-voice | "the data that size is designed to hold" — an active rewrite would have to name a designer or shift to "targets", which changes the nuance of a capacity statement. |
| docs/accessanalyzer/26.1/install/requirements.md:33 — Dale: passive-voice | "a virtual machine provisioned at exactly the stated figure" is a reduced relative clause functioning as a participial adjective; naming an actor would add words without adding clarity. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/accessanalyzer/26.1/install/requirements.md

• Completeness — Line 84: The row lists ports 9000 and 8123, but those are only correct for the LoadBalancer access type. The linked page's NodePort option uses ports in the 30000–32767 range, so a reader who chose NodePort opens the wrong ports and the connection fails. Suggested fix: "Direct access to the analytics store. Open them only if you open the analytics store's ports. With the NodePort access type, open the node ports you chose instead."
• Clarity — Line 84: "analytics store" appears on this page for the first time with no gloss. Everywhere else in the 26.1 docs it carries one — settings/backups.md and known-limitations.md both say "the analytics store behind dashboards and reports." Suggested fix: "Direct access to the analytics store, the database behind dashboards and reports."
• Completeness — Line 84: The 4504 row tells the reader its traffic is TLS-protected, but this row doesn't say the traffic is unencrypted. Someone planning firewall rules from this page alone won't learn that until they open the linked page. Suggested fix: add "The traffic is unencrypted." to the Purpose cell.

docs/accessanalyzer/26.1/integrations/index.md

• Structure — Line 10: The new paragraph adds a second integration to the page, but the frontmatter description still covers only the first: "How Netwrix Activity Monitor connects to Access Analyzer and what it adds." Suggested fix: broaden it, for example "How Netwrix Activity Monitor connects to Access Analyzer, and how to let an external tool query the analytics store."
• Completeness — Line 10: "the analytics store's ports" is the reader's first encounter with the term on this page, and it arrives with no explanation of what the analytics store holds or why an external tool would want it. Suggested fix: "You can also open the ports of the analytics store, the ClickHouse database behind the dashboards and reports, so an external tool such as a business intelligence (BI) platform can query it directly."

docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md

• Completeness — Line 7: dspmctl appears nowhere else in the 26.1 documentation — the only command the install docs describe is dspm-installer. The page never says where dspmctl comes from, whether the installer puts it on the path, or where the binary lives, so a reader who follows the first step may find the command not found. Suggested fix: add a Prerequisites bullet, for example "The dspmctl command. The installer puts dspmctl in /usr/local/bin on the Access Analyzer server."
• Completeness — Line 95: kubectl also appears nowhere else in the 26.1 documentation. The reader is never told that the bundled k3s cluster provides it, or how to invoke it on a server where it isn't on the path. Suggested fix: note that the bundled k3s cluster installs kubectl, or give the bundled form: "sudo k3s kubectl get svc clickhouse-external -n access-analyzer".
• Completeness — Lines 111 and 114: Line 37 establishes that set-helm-param turns automated sync off, and both "Open the ports" and "Close access" follow it with dspmctl sync and dspmctl enable-auto. These two snippets omit those follow-ups, so a reader who runs them leaves the change unapplied and automated sync disabled. Suggested fix: add the sudo dspmctl sync netwrix and sudo dspmctl enable-auto netwrix lines to both snippets, or state once that every set-helm-param change needs the sync and enable-auto steps.
• Clarity — Line 37: "automated sync" is used without explanation — the reader doesn't know what it syncs, why set-helm-param turns it off, or what breaks if they skip step 3. The sentence also sits as bare body text where it reads as an aside rather than a caveat that governs the whole procedure. Suggested fix: use an admonition and explain the mechanism: ":::note\ndspmctl set-helm-param pauses the automated sync that keeps the running application matched to its stored configuration. Steps 2 and 3 apply your change and turn the sync back on.\n:::"
• Structure — Lines 108–112: The first limitation is a security bypass — with LoadBalancer, a client can reach the database through the per-node port and get around the allowed address ranges. A reader following the page top to bottom learns this only after opening the ports and verifying external access, by which point the exposure already exists. Suggested fix: move it into "Choose an access type" next to the LoadBalancer recommendation, or reference it from the warning at line 18.
• Clarity — Lines 108 and 114: "a port on every node" and "any node in the cluster" assume a multi-node cluster, but install/requirements.md states that Access Analyzer installs on a single server. The reader has no mental model of other nodes, so neither limitation lands. Suggested fix: ground it in the single-server deployment, for example "Kubernetes also opens this port on the server itself."
• Clarity — Line 29: The section is titled "Choose an access type" but never names the choice before discussing it. It opens with ServiceLB and assumes the reader already knows that LoadBalancer and NodePort are the two Kubernetes service types on offer. Suggested fix: lead with the choice — "Access Analyzer exposes the ports as one of two Kubernetes service types: LoadBalancer or NodePort. Use LoadBalancer unless the ports are unavailable."
• Clarity — Line 72: Step 4 says "Open the chosen ports," but with LoadBalancer the reader chose nothing — the ports are fixed at 9000 and 8123. Only the NodePort path involves a choice. Suggested fix: "Open the ports on the server's firewall: 9000 and 8123 for LoadBalancer, or the node ports you set for NodePort."
• Completeness — Lines 92–95: Step 1 says to list "the assigned ports and address," but doesn't say which columns of the kubectl get svc output hold them, and no sample output is shown. This matters most on the NodePort path, where reading the assigned port is the whole point of the step. Suggested fix: name the columns — "Read the address from EXTERNAL-IP and the ports from PORT(S)."
• Completeness — Line 114: "set config.clickhouse.externalAccess.externalTrafficPolicy to Cluster or Local" doesn't say which value is the default or what either one does, so the reader can't tell which to pick. Suggested fix: state the default and the effect of each, for example "Cluster routes traffic to the analytics store from any node; Local accepts it only on the node running the analytics store. The default is Cluster."
• Clarity — Line 39: "For LoadBalancer, restricting access to one address range:" is a sentence fragment introducing the code block. Suggested fix: "This example uses LoadBalancer and restricts access to a single address range:"
• Clarity — Line 76: "with the same per-query memory limits as the user Access Analyzer's own reports use" is hard to parse — "the user" collides with the access_analyzer_external user introduced in the same sentence. Suggested fix: "with the same per-query memory limits that Access Analyzer's own reports use."
• Clarity — Line 16: "Access Analyzer never exposes the metrics port." The metrics port isn't mentioned anywhere else on the page or in the product docs, so the reader can't tell what it is or why the reassurance appears here. Suggested fix: drop the sentence, or name the port and say what it would otherwise carry.

Summary

17 editorial suggestions across 3 files. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

4 issues fixed, 4 skipped across 3 files

Category	Fixes
Dale: idioms	1
Dale: passive-voice	2
Dale: wordiness	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md:37 — Dale: positional-references | 'The last step turns it back on' is an ordinal reference to a numbered step, not a spatial 'above'/'below' reference; rewriting to a specific step number risks going stale if the procedure changes. |
| docs/accessanalyzer/26.1/integrations/external-clickhouse-access.md:39 — Dale: misplaced-modifiers | 'For LoadBalancer, restricting access to one address range:' is a lead-in fragment for a code block; the participle has no stated subject by design, and multiple valid rewrites exist with no clear winner. |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | 'at your own risk' is standard technical and legal phrasing rather than a culturally specific idiom, and it mirrors the installer's own warning. |
| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: idioms | 'The 40 GB floor' uses 'floor' in its established technical sense of a lower bound; changing it would restate a threshold the surrounding paragraph already defines precisely. |

Ask @claude on this PR if you'd like an explanation of any fix.