The SENTRA family
What each product does, where it runs and who uses it.
At a glance#
| Product | Short name | Layer | What it does | Where it runs |
|---|---|---|---|---|
| SENTRA AI Threat Shield | Web App · ATS | Enforce | Inspects every request to a website or API and stops attacks, bots and AI swarms before they reach the server | In front of the web server: on the same server or on a dedicated edge server |
| SENTRA Network Threat Shield | Internet · NTS | Enforce | Cleans all traffic for an organisation's IP addresses inline, before it reaches the network | On a VM or bare-metal box in the internet line |
| SENTRA GUARD | GUARD | Orchestrate | Multi-tenant control plane for customers, nodes, firewalls, licences, billing and alerts | A Linux server or VM (one per region or operator) |
| SENTRA VIEW | VIEW | Govern | Fleet command above every GUARD: fleet health, tickets, central billing, price book, access, licensing, updates | A Linux server or VM |
| SENTRA Licensing Authority | Licensing portal | Trust | Root of trust: designs licence hierarchies, issues and records every licence, approves and signs software releases | SENTRA's own server, licensing.sentra-ai.com |
| SENTRA release server | Release server | Supply | Serves signed software releases | SENTRA's own server, updates.sentra-ai.com |
In the consoles, protection is always named Web App · ATS (AI Threat Shield) and Internet · NTS (Network Threat Shield), and tables use the short tags ATS and NTS. Older material may say WAF for ATS and CleanPipe / DIA for NTS — they mean the same products.
Web App · ATS — SENTRA AI Threat Shield#
An AI web application firewall that works as an inspecting reverse proxy. Point the website's DNS at it; it terminates HTTPS, inspects each request and forwards clean traffic to the web server. Nothing changes in the application.
- Five checks on every request — network, fingerprint, behaviour, AI intent and policy — scored together into one verdict: pass, challenge or block.
- AI agents and swarms — genuine AI agents are verified by signature and network, impostors are caught, and swarms that spread one job across many addresses are treated as one operator.
- Monitor, then Enforce — see what would be stopped on your own traffic first.
- Page Shield and API Shield, response hardening (security headers, cookie flags, HSTS, banner stripping), bans, incidents, reports, and a tamper-evident audit ledger.
- Optional network sensors and threat feeds (Suricata IDS, Zeek, signature updates) and an optional AI analyst & Copilot that can use a private, on-premises language model.
Internet · NTS — SENTRA Network Threat Shield#
An inline network firewall for a whole internet line. Every port gets a role (WAN, LAN, management); a WAN and a LAN port form a segment, which runs either as a bridge (bump in the wire, no addressing change) or routed (the box is the gateway, with NAT).
- Edge protection on every WAN port: allow and block lists, threat feeds, bans, flood limits, per-customer prefixes.
- Stateful policy with objects, services, schedules, expiry and connection limits; NAT; DNS and HTTPS-name filtering; application control; bandwidth shaping.
- Intrusion prevention (Suricata), an AI daemon that learns normal traffic and bans flood sources, VPN (WireGuard, IPsec), multi-WAN, BGP (including remotely triggered blackhole), and high availability pairs.
- Commit-confirm: every change rolls itself back after 60 seconds unless confirmed, so a mistake cannot lock you out of an inline box.
SENTRA GUARD#
The orchestrator an operator uses every day. A GUARD:
- onboards customers, each with their own firewall (ATS or NTS) provisioned on a node;
- registers nodes and watches them live on a radar cockpit (health, bandwidth, latency, threats);
- moves customers between nodes, pushes NTS policy templates, and offers software updates to its nodes;
- issues licences for its boxes (within the limits the Licensing Authority gives it), runs billing (plans, invoices, payments) and sends alerts;
- manages users, roles and access — including who may sign in to each ATS and NTS box — with maker-checker approvals for sensitive actions.
A GUARD works fully on its own. When it is linked to a VIEW, VIEW becomes the boss and the GUARD keeps working (and keeps its own copy of everything) if VIEW is unavailable.
SENTRA VIEW#
Fleet command for operators with more than one GUARD:
- Fleet cockpit — every GUARD, node and customer at once, with an interactive hierarchy map.
- Customers, services and nodes across all GUARDs, with the ability to create and change them on any GUARD.
- Tickets with SLA (ticketing lives only in VIEW).
- Central billing and the fleet price book, pushed to every GUARD.
- Access across the fleet — users and roles on every GUARD and box.
- Licensing — VIEW is certified as a signing authority and licenses its whole fleet automatically from the plan designed in the Licensing Authority, even while disconnected.
- Software updates for itself, its GUARDs and their nodes, from the signed release server.
SENTRA Licensing Authority#
SENTRA's own portal at licensing.sentra-ai.com. It holds the SENTRA root signing key in an AES-256-GCM encrypted vault that is sealed after every restart, forces two-factor sign-in, and:
- designs the hierarchy for each customer deployment (stand-alone ATS or NTS, GUARD with boxes, VIEW fleet) and what each level is entitled to;
- issues licences and certifies VIEWs and GUARDs as signing authorities with limits;
- keeps a register of every licence ever issued and sees which systems check in;
- approves and signs software releases for the release server.
It is operated by SENTRA staff; customers never need access to it.