SENTRADOCUMENTATIONDefinitions of the terms used across the SENTRA consoles and documentation, with frequently asked questions for customers and for SENTRA staff.
Every term you will meet in the SENTRA consoles and documentation, A to Z.
| Term | Meaning |
|---|---|
| Active test | ATS tool that runs well-known assessment tools (nmap, nikto, gobuster, nuclei, whatweb) against a website you own. |
| Admin (role) | A built-in role. On ATS: most protection and policy rights; on NTS: the built-in role with every permission; on GUARD: day-to-day administration. |
| Agent (node agent) | The small program on every node that receives work from its GUARD (provision, update, users, licences) and reports health, traffic and threats. |
| Agent maze | ATS feature that serves believable decoy pages to bots that keep returning after being blocked. |
| AI agents | Automated clients such as AI crawlers and assistants. ATS verifies genuine ones by signature and network (the good-agent passport) and catches impostors. |
| AI analyst / Copilot | Optional AI module (sentra-ai on ATS) that gives second opinions on traffic, AI assessments and a chat assistant; can use a private on-premises model. |
| Allow list / trust list | Addresses or networks that are always allowed. |
| API Shield | ATS feature that validates requests to configured API routes against a schema (content type, size, tokens, JSON fields). |
| Approvals (maker-checker, four eyes) | Sensitive actions need a second, different person to approve. No self-approval. |
| Audit ledger / audit trail | The record of security decisions and admin actions. On ATS, VIEW and the Licensing Authority it is tamper-evident (hash-chained). |
| ATS | Web App · ATS — SENTRA AI Threat Shield, the AI web application firewall. Older material calls it WAF or SENTRA SHIELD. |
| Authority (signing authority) | A VIEW or GUARD certified by the Licensing Authority to issue licences for its own fleet within limits. |
| Authority certificate (OTGA1) | The certificate that makes a VIEW or GUARD an authority: its public key, products, modules, limits and latest expiry, signed by the SENTRA root key. |
| Ban | A temporary block on a source address after repeated bad behaviour; set automatically or by hand. |
| BGP / RTBH | NTS routing with internet carriers; remotely triggered blackhole asks carriers to drop traffic to an address under attack. |
| Billing mode | Whether a GUARD bills its own customers (Billing on this GUARD) or VIEW does it (Billing from VIEW). |
| Block line / challenge line | ATS risk thresholds: above the challenge line a visitor gets a browser check; above the block line the request is blocked. |
| Bridge segment | NTS mode where the box sits in the wire between a WAN and a LAN port without IP addresses. |
| Bypass | ATS emergency switch that sends website traffic straight to the web server without inspection. On NTS bare metal, a bypass network card can keep the line up in hardware. |
| Campaign | Several events or addresses grouped because they are one attacker or one job. |
| Candidate (release) | A built and tested version waiting for approval in the Licensing Authority's Releases page. |
| Check-in | A system telling the Licensing Authority which keys it holds; returns revocations and renewals. |
| CleanPipe / DIA | Older name for protecting a customer's Dedicated Internet Access line — now Internet · NTS. |
| Commit-confirm | NTS safety net: a change goes live at once and rolls back after 60 seconds unless confirmed. |
| Customer | An organisation protected by an operator's GUARD; has a plan and one firewall (ATS or NTS). Also a GUARD role for the customer's own portal users. |
| Deploy (policy) | Making staged policy changes live. Each kept deploy is a revision you can roll back to. |
| Deployment (licensing) | In the Licensing Authority: one customer's designed hierarchy (stand-alone, GUARD, or VIEW fleet) and the licences issued for it. |
| Device role | The role a GUARD user gets when signing in to an ATS or NTS box (admin, operator, viewer or none), mapped to a local role on the box. |
| DIA | Dedicated Internet Access — a business internet line with its own IP block. |
| Drain | Stop placing new firewalls on a node. |
| Edge (ATS) | A dedicated server running ATS on ports 80/443 in front of real websites. |
| Enforce | Mode in which a shield blocks, challenges and bans. Compare Monitor. |
| Fail-open | If a shield stops working, traffic flows without inspection rather than stopping. |
| Five checks | ATS's network, fingerprint, behaviour, AI intent and policy checks on every request. |
| Fleet | Everything under a VIEW: GUARDs, nodes, customers and firewalls. |
| Glass-break account | A local admin on an ATS or NTS box that works only while its GUARD is unreachable. Every use is audited and alerted. |
| Grace period | 30 days during which an unlicensed module works normally. |
| GUARD | SENTRA GUARD, the multi-tenant orchestrator. Named OTG-OR-01, OTG-OR-02, … |
| HA pair | Two NTS boxes sharing addresses with VRRP and synchronised sessions. |
| Incident | A group of related security events that needs attention. |
| Installation ID (IID) | The unique ID of an ATS or NTS box (format OTG-XXXX-XXXX-XXXX-XXXX); licences are bound to it. |
| Instance | One provisioned firewall engine for one customer on a node. |
| IPS / IDS | Intrusion prevention / detection (Suricata). IDS observes; IPS can drop. |
| Jump in | Opening a GUARD's console from VIEW with a single-use pass, limited to a maximum role. |
| KEV | CISA's Known Exploited Vulnerabilities list; ATS reports which of them it has virtual patches for. |
| Licence key | A signed text key. OTG1: signed by the SENTRA root. OTG2: issued by an authority, carrying its certificate. |
| Licensing Authority | SENTRA's portal at licensing.sentra-ai.com — the root of trust. |
| Live | The real-time view of requests (ATS) or traffic (NTS). |
| Lockout | Temporary refusal of sign-ins after repeated wrong passwords. |
| Master Admin | The fixed top role on ATS and GUARD with every permission; cannot be edited or deleted. VIEW's equivalent is Super Admin. |
| Module | A licensable part of a product: sentra, sentra-ids, sentra-ai (ATS); sentra-nts (NTS). |
| Monitor | Mode in which a shield records what it would stop without blocking. |
| Multi-WAN | NTS using several internet links for failover or balance. |
| Node | A server or VM registered on a GUARD that runs ATS or NTS for customers. Named OTG-SH-01, … for shields. |
| NTS | Internet · NTS — SENTRA Network Threat Shield, the inline network firewall. Older material calls it SENTRA CPI or CleanPipe. |
| NTS policies (templates) | Policy sets kept in GUARD with revisions and pushed to chosen NTS nodes. |
| OMM | Internal name of SENTRA VIEW's software (you may see it in service names and logs). |
| OTG | Orchestrated Threat Governance, the SENTRA ecosystem. |
| Overview | The ATS home dashboard, customisable per user. |
| Page Shield | ATS feature that watches the scripts a page loads and alerts on new or injected ones. |
| Permission | One named right (for example Deploy & rollback). Roles are sets of permissions. |
| Plan / price book | What a customer pays monthly. VIEW's fleet price book is pushed to every GUARD. |
| Policy | The rules a shield applies. Changes are staged, deployed and kept as revisions. |
| Release server | updates.sentra-ai.com, which serves signed releases. |
| Restricted | Licence state after the grace period: protection continues, changes for that module pause. |
| Revision | A numbered, kept version of a deployed policy. |
| Revoked | A key the Licensing Authority has withdrawn; shown on the box after check-in. |
| Role | A named set of permissions given to users. Fully customisable on every product. |
| Root key | SENTRA's root signing key. Its public half is built into every product; its private half lives only in the Licensing Authority's vault and SENTRA's offline copy. |
| Routed segment | NTS mode where the box is the gateway with NAT and its own routing. |
| Scanner | ATS's safe, passive security assessment of a website you own. |
| Scorecard (Bot Scorecard) | ATS's quick, harmless test of how well a website keeps bots out. |
| Seats | The number of customers a GUARD licence allows. |
| Segment | An NTS pair of WAN and LAN ports with its own mode and policy. |
| Sealed (vault) | The Licensing Authority's state after a restart, until the vault passphrase is entered. |
| Shadow review | Reviewing, in Monitor mode, what would have been stopped and trusting legitimate traffic before Enforce. |
| Signed release | A software version signed by SENTRA's release key; every system checks it before installing. |
| Snapshot | The copy of a GUARD's records it sends to VIEW every 2 seconds. |
| Stand-alone | An ATS or NTS (or GUARD) that runs without a managing tier above it. |
| Step-up | Asking for a fresh two-factor code before a sensitive action. |
| Super Admin | The fixed top role on VIEW and in the Licensing Authority. |
| Swarm | Many addresses doing one job; ATS treats them as one operator. |
| Tarpit | Deliberately slowing responses to an abusive client. |
| Ticket | A customer fault or alarm tracked with SLA in VIEW. |
| TOTP / 2FA | Time-based one-time codes from an authenticator app, required at sign-in. |
| Value report | ATS report of what was stopped in a period, with a clearly labelled estimate (RM) of what that saved. |
| VIEW | SENTRA VIEW, fleet command above every GUARD. |
| Virtual patch | An ATS rule that blocks exploitation of a specific CVE until the application is patched. |
| Vault | The Licensing Authority's encrypted store (AES-256-GCM). |
| Wall mode | A full-screen display for NOC screens (ATS and NTS). |
| Withdraw (release) | Marking a published release as withdrawn so no system offers or installs it. |
Answers to the questions customers and website owners ask most.
Does my traffic go to SENTRA? No. The shields run on your infrastructure (or your provider's) and inspect traffic where it arrives. SENTRA's own services only handle licences and software releases. See Your data, and what stays on-premises.
Will SENTRA slow my website down? ATS inspects each request in-line and shows the median inspection time on its Overview. Requests that pass all five checks go straight through.
What happens if the shield fails? SENTRA fails open. On an ATS edge server a guard sends traffic straight to your web server within seconds if the shield stops answering, and raises an alert. An NTS bridge keeps forwarding even if its software stops.
Can I see what SENTRA would block before it blocks anything? Yes. Every shield starts in Monitor mode, which records what would be stopped on your real traffic. Switch to Enforce when you are happy.
What if my licence expires? Protection never stops. An unlicensed module has 30 days of grace, then changes and updates for that module pause until a key is added. Inspection, rules, bans and the traffic path keep working.
Do I need to change my website? No. You point your website's DNS at the shield; it terminates HTTPS and forwards clean traffic to your server.
Will search engines and legitimate AI crawlers still reach my site? Yes. Genuine agents are verified by signature and network; impostors pretending to be them are caught. You decide what each kind of agent may do.
Who can sign in to my shield's console? Whoever your administrator creates, with the role they assign. Roles are fully customisable, and two-factor sign-in is available for every user.
Do I have to change my network? Not in bridge mode: NTS sits in the wire between your router and your network without any addressing changes. In routed mode NTS becomes your gateway.
Can a configuration mistake cut off my internet? NTS uses commit-confirm: every change rolls itself back after 60 seconds unless it is confirmed.
Can NTS filter websites for my staff or family? Yes — DNS and HTTPS-name filtering by category or list, with application control and bandwidth shaping.
How do I get help? Customers of a SENTRA operator raise tickets from their customer portal; the operator works them in SENTRA VIEW. For SENTRA directly, write to demo@sentra-ai.com.
Answers to the operational questions staff ask most — sign-in, licensing, updates and recovery.
For step-by-step procedures see the Operations Runbooks.
I'm locked out of an ATS or NTS box. What now? If the box is managed by a GUARD, sign in with your GUARD account or open the box from the GUARD's node page. If the GUARD is unreachable, use the box's glass-break account. A local password can also be reset from the box's command line (see the product's admin manual). Wrong passwords lock an address out for a while — wait rather than retrying.
Why can't I see Users & roles on a GUARD I opened from VIEW? When you jump in from VIEW your role is capped at that GUARD's max jump-in role. Raise it on the GUARD and on VIEW, or sign in to the GUARD directly.
Who can change roles? Only the Super Admin on VIEW, and only master admins on GUARD and ATS (the built-in Admin on NTS). Built-in top roles can't be edited or deleted, and the last top-level admin can't be removed.
How do I license a new customer? Design the deployment in the Licensing Authority (Design & issue). VIEW and GUARD authorities then license their boxes automatically from the plan. Stand-alone boxes get a key bound to their Installation ID.
A box shows a licence as revoked. The Licensing Authority revoked it and the box learned this at check-in. Issue or renew a key in the Licensing Authority; the box picks it up at the next check-in (or Check in now).
Does a box need internet for its licence? No. Keys are checked offline. Online check-in only adds revocations and renewals.
How do I ship a new version? The release builder tests every new version automatically. Open Releases in the Licensing Authority, review the candidate and its test log, and Approve & publish with a fresh 2FA code. Then update VIEW; GUARDs and nodes follow.
A candidate says "needs a version bump". The code on main changed after that version was published. A new release needs a new version number and changelog entry.
Can I stop unsigned code from ever being installed?
Yes. Set GUARDs to require signed releases (OTG_REQUIRE_SIGNED=1) and nodes likewise (SENTRA_REQUIRE_SIGNED=1), once everything runs a version that supports signed releases.
VIEW is down. Can we still work? Yes. Work on each GUARD directly. Changes reach VIEW when it is back. Tickets wait for VIEW.
Where are prices set? On a GUARD on its own: Billing → Plans & pricing. Under VIEW: VIEW's Plans & pricing, pushed to every GUARD.
How do I reset a forgotten console password?
ATS: sudo sentra-shield passwd <user> and sudo sentra-shield 2fa-reset <user> on the box. NTS: sudo sentra-nts passwd --user <user> and --reset-2fa. Licensing Authority: sudo sentra-licensing reset-2fa <user> / unlock <user>.