Glossary
Every term you will meet in the SENTRA consoles and documentation, A to Z.
| Term | Meaning |
|---|---|
| Active test | ATS tool that runs well-known assessment tools (nmap, nikto, gobuster, nuclei, whatweb) against a website you own. |
| Admin (role) | A built-in role. On ATS: most protection and policy rights; on NTS: the built-in role with every permission; on GUARD: day-to-day administration. |
| Agent (node agent) | The small program on every node that receives work from its GUARD (provision, update, users, licences) and reports health, traffic and threats. |
| Agent maze | ATS feature that serves believable decoy pages to bots that keep returning after being blocked. |
| AI agents | Automated clients such as AI crawlers and assistants. ATS verifies genuine ones by signature and network (the good-agent passport) and catches impostors. |
| AI analyst / Copilot | Optional AI module (sentra-ai on ATS) that gives second opinions on traffic, AI assessments and a chat assistant; can use a private on-premises model. |
| Allow list / trust list | Addresses or networks that are always allowed. |
| API Shield | ATS feature that validates requests to configured API routes against a schema (content type, size, tokens, JSON fields). |
| Approvals (maker-checker, four eyes) | Sensitive actions need a second, different person to approve. No self-approval. |
| Audit ledger / audit trail | The record of security decisions and admin actions. On ATS, VIEW and the Licensing Authority it is tamper-evident (hash-chained). |
| ATS | Web App · ATS — SENTRA AI Threat Shield, the AI web application firewall. Older material calls it WAF or SENTRA SHIELD. |
| Authority (signing authority) | A VIEW or GUARD certified by the Licensing Authority to issue licences for its own fleet within limits. |
| Authority certificate (OTGA1) | The certificate that makes a VIEW or GUARD an authority: its public key, products, modules, limits and latest expiry, signed by the SENTRA root key. |
| Ban | A temporary block on a source address after repeated bad behaviour; set automatically or by hand. |
| BGP / RTBH | NTS routing with internet carriers; remotely triggered blackhole asks carriers to drop traffic to an address under attack. |
| Billing mode | Whether a GUARD bills its own customers (Billing on this GUARD) or VIEW does it (Billing from VIEW). |
| Block line / challenge line | ATS risk thresholds: above the challenge line a visitor gets a browser check; above the block line the request is blocked. |
| Bridge segment | NTS mode where the box sits in the wire between a WAN and a LAN port without IP addresses. |
| Bypass | ATS emergency switch that sends website traffic straight to the web server without inspection. On NTS bare metal, a bypass network card can keep the line up in hardware. |
| Campaign | Several events or addresses grouped because they are one attacker or one job. |
| Candidate (release) | A built and tested version waiting for approval in the Licensing Authority's Releases page. |
| Check-in | A system telling the Licensing Authority which keys it holds; returns revocations and renewals. |
| CleanPipe / DIA | Older name for protecting a customer's Dedicated Internet Access line — now Internet · NTS. |
| Commit-confirm | NTS safety net: a change goes live at once and rolls back after 60 seconds unless confirmed. |
| Customer | An organisation protected by an operator's GUARD; has a plan and one firewall (ATS or NTS). Also a GUARD role for the customer's own portal users. |
| Deploy (policy) | Making staged policy changes live. Each kept deploy is a revision you can roll back to. |
| Deployment (licensing) | In the Licensing Authority: one customer's designed hierarchy (stand-alone, GUARD, or VIEW fleet) and the licences issued for it. |
| Device role | The role a GUARD user gets when signing in to an ATS or NTS box (admin, operator, viewer or none), mapped to a local role on the box. |
| DIA | Dedicated Internet Access — a business internet line with its own IP block. |
| Drain | Stop placing new firewalls on a node. |
| Edge (ATS) | A dedicated server running ATS on ports 80/443 in front of real websites. |
| Enforce | Mode in which a shield blocks, challenges and bans. Compare Monitor. |
| Fail-open | If a shield stops working, traffic flows without inspection rather than stopping. |
| Five checks | ATS's network, fingerprint, behaviour, AI intent and policy checks on every request. |
| Fleet | Everything under a VIEW: GUARDs, nodes, customers and firewalls. |
| Glass-break account | A local admin on an ATS or NTS box that works only while its GUARD is unreachable. Every use is audited and alerted. |
| Grace period | 30 days during which an unlicensed module works normally. |
| GUARD | SENTRA GUARD, the multi-tenant orchestrator. Named OTG-OR-01, OTG-OR-02, … |
| HA pair | Two NTS boxes sharing addresses with VRRP and synchronised sessions. |
| Incident | A group of related security events that needs attention. |
| Installation ID (IID) | The unique ID of an ATS or NTS box (format OTG-XXXX-XXXX-XXXX-XXXX); licences are bound to it. |
| Instance | One provisioned firewall engine for one customer on a node. |
| IPS / IDS | Intrusion prevention / detection (Suricata). IDS observes; IPS can drop. |
| Jump in | Opening a GUARD's console from VIEW with a single-use pass, limited to a maximum role. |
| KEV | CISA's Known Exploited Vulnerabilities list; ATS reports which of them it has virtual patches for. |
| Licence key | A signed text key. OTG1: signed by the SENTRA root. OTG2: issued by an authority, carrying its certificate. |
| Licensing Authority | SENTRA's portal at licensing.sentra-ai.com — the root of trust. |
| Live | The real-time view of requests (ATS) or traffic (NTS). |
| Lockout | Temporary refusal of sign-ins after repeated wrong passwords. |
| Master Admin | The fixed top role on ATS and GUARD with every permission; cannot be edited or deleted. VIEW's equivalent is Super Admin. |
| Module | A licensable part of a product: sentra, sentra-ids, sentra-ai (ATS); sentra-nts (NTS). |
| Monitor | Mode in which a shield records what it would stop without blocking. |
| Multi-WAN | NTS using several internet links for failover or balance. |
| Node | A server or VM registered on a GUARD that runs ATS or NTS for customers. Named OTG-SH-01, … for shields. |
| NTS | Internet · NTS — SENTRA Network Threat Shield, the inline network firewall. Older material calls it SENTRA CPI or CleanPipe. |
| NTS policies (templates) | Policy sets kept in GUARD with revisions and pushed to chosen NTS nodes. |
| OMM | Internal name of SENTRA VIEW's software (you may see it in service names and logs). |
| OTG | Orchestrated Threat Governance, the SENTRA ecosystem. |
| Overview | The ATS home dashboard, customisable per user. |
| Page Shield | ATS feature that watches the scripts a page loads and alerts on new or injected ones. |
| Permission | One named right (for example Deploy & rollback). Roles are sets of permissions. |
| Plan / price book | What a customer pays monthly. VIEW's fleet price book is pushed to every GUARD. |
| Policy | The rules a shield applies. Changes are staged, deployed and kept as revisions. |
| Release server | updates.sentra-ai.com, which serves signed releases. |
| Restricted | Licence state after the grace period: protection continues, changes for that module pause. |
| Revision | A numbered, kept version of a deployed policy. |
| Revoked | A key the Licensing Authority has withdrawn; shown on the box after check-in. |
| Role | A named set of permissions given to users. Fully customisable on every product. |
| Root key | SENTRA's root signing key. Its public half is built into every product; its private half lives only in the Licensing Authority's vault and SENTRA's offline copy. |
| Routed segment | NTS mode where the box is the gateway with NAT and its own routing. |
| Scanner | ATS's safe, passive security assessment of a website you own. |
| Scorecard (Bot Scorecard) | ATS's quick, harmless test of how well a website keeps bots out. |
| Seats | The number of customers a GUARD licence allows. |
| Segment | An NTS pair of WAN and LAN ports with its own mode and policy. |
| Sealed (vault) | The Licensing Authority's state after a restart, until the vault passphrase is entered. |
| Shadow review | Reviewing, in Monitor mode, what would have been stopped and trusting legitimate traffic before Enforce. |
| Signed release | A software version signed by SENTRA's release key; every system checks it before installing. |
| Snapshot | The copy of a GUARD's records it sends to VIEW every 2 seconds. |
| Stand-alone | An ATS or NTS (or GUARD) that runs without a managing tier above it. |
| Step-up | Asking for a fresh two-factor code before a sensitive action. |
| Super Admin | The fixed top role on VIEW and in the Licensing Authority. |
| Swarm | Many addresses doing one job; ATS treats them as one operator. |
| Tarpit | Deliberately slowing responses to an abusive client. |
| Ticket | A customer fault or alarm tracked with SLA in VIEW. |
| TOTP / 2FA | Time-based one-time codes from an authenticator app, required at sign-in. |
| Value report | ATS report of what was stopped in a period, with a clearly labelled estimate (RM) of what that saved. |
| VIEW | SENTRA VIEW, fleet command above every GUARD. |
| Virtual patch | An ATS rule that blocks exploitation of a specific CVE until the application is patched. |
| Vault | The Licensing Authority's encrypted store (AES-256-GCM). |
| Wall mode | A full-screen display for NOC screens (ATS and NTS). |
| Withdraw (release) | Marking a published release as withdrawn so no system offers or installs it. |