Products side by side

A one-page comparison of every SENTRA product — job, placement, management, licensing and requirements.

Web App · ATS — SENTRA AI Threat Shield

Datasheet for the AI web application firewall that protects websites and APIs (version 2.26).

Version: 2.26 · Layer: Enforce · Type: AI web application firewall (inspecting reverse proxy)

An AI web application firewall that sits in front of a website and inspects every request before it reaches the server. Injection, credential stuffing, scrapers, AI agent swarms and floods are stopped at the edge, with no change to the application.

Key capabilities#

Inspection#

• Five checks on every request — network, fingerprint, behaviour, AI intent and policy — scored together into one verdict. Clear attacks are blocked, likely ones challenged (browser check), everyone else passes straight through. The challenge and block lines are adjustable, with Balanced, Strict and Paranoid strategies.
• Monitor and Enforce modes — Monitor records what would be stopped; Enforce blocks, challenges and bans.
• AI agents and swarms — the good-agent passport verifies genuine AI agents and crawlers by signature and network and catches impostors; swarms that spread one job across many addresses are grouped into one campaign and contained.
• Agent maze — bots that keep coming back after being blocked get believable decoy pages instead of an error.
• Virtual patches for specific, actively exploited CVEs, with coverage reporting against the CISA Known Exploited Vulnerabilities list.
• Breached-password check at sign-in (k-anonymity; the password never leaves the box).
• Rate limits, tarpit and automatic bans; allow and block lists by address, network, country and ASN.

Site protection#

• Page Shield — watches the scripts your pages load and alerts on new or injected ones.
• API Shield — validates content types, sizes, tokens and JSON fields per API route.
• Response hardening — adds missing security headers, cookie flags and HSTS; strips version banners.
• Websites and certificates (edge) — add websites, automatic Let's Encrypt certificates, per-site inspect or pass-through, emergency bypass.
• Fail-open guard (edge) — if the shield stops answering, traffic goes straight to the web server within seconds and an alert is raised.

Intelligence (module sentra-ids)#

• IDS hub — Suricata and Zeek network sensors in one real-time view.
• Threat feeds — open IDS signature sets and IP reputation lists, updated automatically.

AI analyst & Copilot (module sentra-ai)#

• AI second opinions on traffic, AI assessments and the Copilot assistant.
• Works with OpenAI-compatible providers, including private on-premises models (Ollama, vLLM, LM Studio, NIM).
• Cross-model disagreement telemetry flags adversarial probing.

Operations#

• Overview dashboard, customisable per user (widgets, order, size) with a default layout for everyone; Live view; wall mode for NOC screens.
• Incidents and campaigns, events, who (visitor investigation), bans.
• Policy with staged changes, deploy and roll back to earlier revisions (deterministic policy compiler).
• Reports — report builder with sections, periods and filters; schedules by e-mail; archive; print/PDF and CSV. Value report with a clearly labelled estimate of what was saved.
• Tools — passive security Scanner, Bot Scorecard, and Active test (optional assessment tools: nmap, nikto, gobuster, nuclei, whatweb) for sites you own.
• Security drills to rehearse attacks safely.
• LAN storm guard — detects broadcast, multicast and ARP storms and switching loops.
• Alerts in plain language by Telegram and WhatsApp (English, Bahasa Melayu or both), daily and monthly summaries; e-mail (SMTP) for scheduled reports.

Deployment#

Requirements#

Ports and protocols#

Integrations#

Telegram, WhatsApp (Meta templates), SMTP e-mail; Suricata, Zeek; OpenAI-compatible AI providers and private models; S3-compatible storage, SFTP or a folder for off-box backups; Let's Encrypt; SENTRA GUARD (node agent and central identity).

Licensing#

No user or site count. 30 days of grace for an unlicensed module, then restricted: protection continues, changes for that module pause.

Management and security#

• Users with fully customisable roles (15 permissions in four groups; built-in Master Admin), two-factor sign-in, sign-in rules, and a glass-break account for when the managing GUARD is unreachable.
• Central identity from SENTRA GUARD when managed: GUARD users sign in with their GUARD accounts, mapped to local roles.
• Tamper-evident audit ledger of security decisions and admin actions.
• Backups nightly, with optional encrypted off-box destinations; restore from the console or command line.
• Signed updates from the release server, installed only when an admin chooses.

Internet · NTS — SENTRA Network Threat Shield

Datasheet for the inline network firewall that keeps a whole internet line clean (version 0.18).

Version: 0.18 · Layer: Enforce · Type: inline network firewall (layers 2, 3 and 4)

Protects a whole internet line, not just one website. NTS sits between the internet and the network and cleans all traffic for the organisation's IP addresses before it arrives — so mail servers, VPNs, remote access and every other service behind the line are protected.

How it sits in the line#

Every physical port gets a role: WAN, LAN, management or unused. A WAN and a LAN port form a segment; one box can run several segments of both kinds:

Fail-open: a bridge keeps forwarding even if SENTRA software stops; on bare metal a bypass network card can be driven by NTS.

Key capabilities#

Protection layers#

Networking#

• VPN — WireGuard for remote users and branches (client config and QR code shown once), IPsec IKEv2 for other firewalls; full or split tunnel.
• Multi-WAN — failover or weighted balance across several internet links, with health checks and alerts.
• BGP — announce your own space, take default or full tables, local preference, AS-path prepending, BFD, max-prefix, ECMP, and remotely triggered blackhole to ask carriers to drop attack traffic.
• High availability — two identical boxes with VRRP and synchronised sessions; failover in about 3 seconds; every deploy on the primary is sent to the secondary.
• Interfaces — bonds, VLANs, bridges, per-port MTU (jumbo frames), built from drop-downs.

Operations#

• Monitor and Enforce for the protection layers; explicit policy rules always apply.
• Commit-confirm — every change goes live at once and rolls itself back after 60 seconds unless confirmed.
• Staged changes and revisions — see exactly what a deploy would change; every kept deploy is a numbered revision that can be compared and restored.
• Dashboard customisable per user, with a default layout for everyone; wall mode; light and dark themes.
• Reports — report builder with sections, schedules and e-mail; daily, weekly and monthly reports kept on the box.
• Policy templates — export a box's policy and import it on another; GUARD pushes templates to chosen NTS nodes.
• Alerts — Telegram, e-mail and webhook (Slack, Teams or any JSON endpoint), with a daily digest.
• LAN storm guard — broadcast, multicast and ARP limits per device on every LAN port.

Deployment#

Requirements#

Ports and protocols#

Licensing#

Module sentra-nts (or all), bound to the box's Installation ID. 30 days of grace, then changes, AI bans and feed updates pause — protection itself never stops.

Management and security#

• Console with two-factor sign-in and fully customisable roles (16 permissions in 11 groups; built-in Admin).
• Managed by SENTRA GUARD through the node agent when part of a fleet, with central identity and a configurable mapping of GUARD roles to local roles; a glass-break admin works only while the GUARD is unreachable.
• Audit log of every change; signed updates from the release server, installed only when an admin chooses.

SENTRA GUARD

Datasheet for the multi-tenant orchestrator that runs SENTRA as a service (version 1.25).

Version: 1.25 · Layer: Orchestrate · Type: multi-tenant control plane

SENTRA GUARD runs SENTRA as a service. It onboards customers, provisions a firewall for each on the operator's nodes, watches node health and bandwidth live, moves customers between nodes, and handles licences, billing, alerts and access. GUARDs are named OTG-OR-01, OTG-OR-02, ….

Key capabilities#

Working with and without VIEW#

• On its own a GUARD is a complete system: customers, nodes, billing, users and licensing.
• Linked to VIEW, it sends VIEW a snapshot every 2 seconds and carries out VIEW's changes through its own rules. If VIEW is unavailable the GUARD keeps working and catches VIEW up when it returns.
• Prices become read-only once VIEW pushes a fleet price book; with Billing from VIEW only VIEW bills its customers.

Deployment#

Requirements#

Ports and protocols#

Node agents connect to the GUARD (polling every 10 seconds by default); the GUARD never needs to reach into a node.

Licensing#

A GUARD licence carries seats and a tier. With an authority certificate from the Licensing Authority (or from its VIEW), the GUARD issues chained keys for its ATS and NTS boxes within its limits and reports them back.

Management and security#

Two-factor sign-in, customisable roles, maker-checker approvals, audit log of every action, nightly backups of the GUARD and every node under it (sent to VIEW and/or an extra S3, SFTP or folder destination, sealed with the GUARD's backup key), signed releases from VIEW (can be locked to signed releases only), and per-node control over updates.

SENTRA VIEW

Datasheet for fleet command above every SENTRA GUARD (version 1.25).

Version: 1.25 · Layer: Govern · Type: fleet command centre

SENTRA VIEW is the cockpit above every SENTRA GUARD: orchestrators, nodes and customers at once, with fleet traffic, alarms, tickets, central billing, the fleet price book, access across the fleet, licensing and software updates.

Key capabilities#

Built-in roles (all editable by the Super Admin)#

Super Admin (fixed), OMM Admin, NOC Engineer, Billing Officer, Account Manager, Licence Requester, Licence Approver, Security Auditor, Viewer — plus any custom role. Each grant can be fleet-wide or scoped to an orchestrator or a customer.

Deployment#

Installed on its own Linux server or VM with the VIEW installer, which also places the ATS and NTS code beside it so VIEW can hand releases to its GUARDs.

Requirements#

Ports and protocols#

GUARDs connect to VIEW; VIEW never needs to reach into a GUARD.

Licensing#

VIEW holds an authority certificate from the Licensing Authority listing the products, modules, limits and latest expiry it may grant. Keys it issues are chained (OTG2) and reported back.

Management and security#

Two-factor sign-in, customisable roles with per-orchestrator and per-customer scope, maker-checker licence approvals (licence requester / approver), tamper-evident audit trail, encrypted backups, and signed updates.

SENTRA Licensing Authority

Datasheet for the root of trust that issues every SENTRA licence and signs every release (version 1.2).

Version: 1.2 · Layer: Trust & supply · Address: https://licensing.sentra-ai.com

The root of trust for every SENTRA system. It holds the SENTRA root signing key, designs and issues every licence, certifies VIEWs and GUARDs as signing authorities with limits, keeps a record of every key ever issued, and approves and signs software releases. It is operated by SENTRA.

Key capabilities#

Security design#

Release signing#

SENTRA root key (in the vault)
  └─ certifies the release key (OTGRK1)
       └─ signs each product's release list (index.json + index.sig)
            └─ pins the checksum of each package and of every file

The release builder runs as a separate service user, tests each product and prepares candidates — it never signs. The release server (updates.sentra-ai.com) serves only public, signed files, so a second server for 1+1 availability needs only a copy of the published folder.

Interfaces used by SENTRA systems#

Deployment#

Runs on SENTRA's server on 127.0.0.1:8640 (release server 127.0.0.1:8641), published through SENTRA AI Threat Shield, which terminates TLS and inspects every request.