Sentinel Commander — User Guide (v2026.06.024)¶

Intended for operators, administrators, and security technicians interacting with Sentinel via the web interface or the mobile app.

Access & Roles (RBAC)¶

The web interface runs on port 5050 and requires authentication. LDAP is supported (lldap and OpenLDAP).

Login¶

Standard: username + password form. LDAP: same form — credentials are validated against the configured LDAP server.

Two-factor authentication (2FA/TOTP): if enabled for your account, a second step asks for a 6-digit code from Google Authenticator / Authy. Enrollment is done in Settings → 2FA — scan the QR code with your authenticator app and confirm with one code. An admin can disable 2FA for any user who lost their device.

Brute-force protection: 5 failed attempts → IP banned for 5 minutes (configurable). This applies to the login form, Basic auth, and agent auto-registration alike.

Session: absolute timeout 12 h; your role is re-checked from the database every 5 minutes, so a role change takes effect without re-login.

The login page links to the public /status page (read-only fleet overview, auto-refresh every 30 s, no login required).

Dashboard Overview¶

┌──────────────────────────────────────────────────────────────────┐
│  SENTINEL COMMANDER v2026.06  [CS/EN] [🌙] [?] (User) (Alerts)   │
├─────────────────────┬────────────────────────────────────────────┤
│  SYSTEM MONITOR     │  ACTIVE INCIDENTS                          │
│  CPU ████── 45%     │  [!] security  brute-force on hpc-gw       │
│  RAM █████─ 75%     │      [🪄] [👁] [🗑] [✓✓] [#tag] [🔔]      │
│  Disk 20%           │  [!] infra  DISK_FULL proxmox01:/data 92%  │
│  AI latency 1.2s    │      acknowledged ● [#storage]             │
│  RAG: Ready         │  ▙ flapping widget ▟  ▙ health trend ▟     │
├─────────────────────┴────────────────────────────────────────────┤
│  AI CHAT   [suggested: "What changed overnight?"] [LIVE]         │
│  Sentinel: Detected memory error on node-01.                     │
│  > Enter query, command, or drag&drop a log file...              │
└──────────────────────────────────────────────────────────────────┘

UI panels¶

Charts: all major charts (dashboard trend, donut, alert timeline, agent sparklines) are interactive — hover shows exact values, a dashed line marks the average, and a min/max/avg badge summarizes the window.

i18n: Toggle between Czech and English via the CS/EN button in the top bar. Dark/light theme via the 🌙 icon. Both preferences persist in localStorage. Display timezone is configurable server-side (DISPLAY_TZ).

Dashboard widgets can be individually shown/hidden in dashboard settings; a live clock sits in the header.

Issue Cards & Workflow¶

Every detected incident appears as a card. The full workflow:

active → acknowledged (✓✓) → validating → resolved

Card actions¶

Additional card features:

• Inline comments — write a comment directly on the card; auto-refresh never wipes text you are typing.
• Colored labels — assign color labels for visual triage.
• Copy as Markdown — one click copies a Markdown summary of the issue (handy for tickets/chat).
• Occurrence counter — repeated detections increment a counter instead of creating duplicates.
• Mobile swipe — swipe right = acknowledge, swipe left = delete.
• Virtual scroll — long lists load 50 cards at a time with a "Load more" button.

Bulk operations & keyboard shortcuts¶

Issue tagging¶

Type #tag in the tag input, or define auto-tag rules in config:

auto_tags:
  - pattern: "DISK_FULL"
    tag: "storage"
  - pattern: "fail2ban"
    tag: "security"

Tags are searchable and shown in the tag cloud panel.

Escalation badges¶

If an issue stays unresolved beyond the configured time, its severity rises automatically and a timer badge appears: ⏱ 3h active. Escalation rules are set per channel in config.yaml. Issue lifecycle transitions (CREATED / ACKNOWLEDGED / RESOLVED) can additionally fire webhooks, and critical issues can be mirrored to Gitea as repository issues.

Autofix — Approving AI Proposals¶

1. Click 🪄 Autofix on an incident card (or type autofix in chat).
2. AI analyses the log context and generates a bash command.
3. A "Pending Action" modal appears with the proposed command, risk score, and dry-run preview.
4. Click ✅ Approve — command executes via SSH on the target node. Click ❌ Reject — proposal is discarded.
5. On success: incident enters validating state, then resolved once the detector confirms. Output is shown even for silent commands (exit 0, no output) and the modal stays open until you read the result.

Commands must be on the allowed_commands allowlist in config.yaml. Blocked commands are automatically rejected regardless of admin input — the allowlist is pre-validated before any SSH connection is made.

SSH Jump Host: If the target node is behind a bastion, Autofix automatically uses ProxyJump.

SSH Modal & Batch SSH (admin+)¶

Direct SSH access to any agent from the Web UI without going through the Autofix pipeline:

1. Click any agent in the Agents view → open the agent detail modal.
2. Click SSH button (requires admin or superadmin).
3. Type commands — output streams live in the modal.
4. All commands are logged in the audit trail.

Batch SSH: the "Batch SSH" modal lets you run one allowlisted command on up to 50 agents in parallel (checkbox list with online/offline indicators); results are shown per host with OK/FAIL colors. Each host has its own 15 s timeout so one stuck node cannot block the batch.

SSH host keys: the agent detail shows the recorded known_hosts keys with Rescan and Delete actions — host keys are pinned (accept-new), not blindly trusted.

Agent Detail¶

The agent modal aggregates everything about one node:

Registration: the token modal shows the agent token with a copy button and a QR code ({hostname, token, ingest_url}) for phone-assisted setup. Superadmin can bulk-rotate all agent tokens.

AI Chat Commands¶

Chat extras:

• Suggested queries — contextual chips under the input ("What changed overnight?", "Summarize security issues"…).
• LIVE tag — enriches your question with the current active-issue context before sending it to the AI.
• Markdown rendering — AI answers render bold, headings, code blocks (highlight.js) and bullet lists.
• Export chat — one click saves the conversation as Markdown.

Drag & Drop Log Analysis¶

Upload a .log, .txt, or .md file into the chat area (or click the paperclip icon).

• AI context switches from RAG to the uploaded file content (first ~15 000 characters).
• Ask specific questions: "List all DNS errors and when they started."
• Release with clear file command to return to normal RAG mode.

Telemetry, Analytics & Reports¶

Available on the dashboard and under Tools:

• Sparkline graphs — top-6 hottest hosts, temperature over time
• Trend chart — capacity growth with TTC prediction
• Host Heatmap — incident density per host per day
• Health Score — composite grade A–D per agent + 7-day fleet health trend chart
• Anomaly detection — 3σ spikes flagged with red dot on timeline
• Analytics tab — SLA resolution-time table + alert-fatigue chart (false positives per plugin)
• Issue forecast — 7-day linear-regression outlook of issue volume
• Capacity tab — AI capacity planning: per-host HOST/PROBLEM/RECOMMENDATION/PRIORITY cards + capacity prediction (time-to-full for disk/RAM)
• Comparison tab — compare two telemetry time windows (delta + % difference)
• Alert timeline — interactive chart of alert volume with min/max/avg
• Auto-clustering — "Clusters" button groups related issues (same plugin on N hosts / same host with N issues in a 30 min window); AI names the probable root cause
• Postmortem — generate an AI Markdown postmortem for any resolved incident
• Weekly digest — includes flapping issues and average resolution time

Runbooks¶

Tools → Runbooks keeps operational procedures next to the incidents:

• CRUD list of runbooks (create, edit, delete)
• Open any runbook in a modal while working on an issue

Topology Map¶

Available under Tools → Topology:

• Force-directed graph of all agents and their network relationships
• Colour by state: green (OK) → yellow (warning) → red (critical) → grey (offline)
• SNMP CDP/LLDP data merged with agent data
• Click a node to open the agent detail modal

Notification Settings¶

Click any 🔔 icon (issue card, issues toolbar, Plugin Stats):

• Channels — enable/disable notifications per channel (infra / agent / security / root)
• Integrations — toggle each outbound integration (Teams, Slack, Discord, Telegram, Opsgenie, ntfy, Gotify, SMTP, Matrix, PagerDuty, HA, MQTT, Webhook)
• Per-detector — each plugin row in Plugin Stats has its own 🔔 toggle
• Integration credentials are configured inline in the Notifications & Integrations modal (Save + Test buttons per tab); secret fields are never displayed back

Notifications are throttled per severity (critical/security/root 15 min, high 1 h, medium/low 4 h) and failed deliveries retry automatically with backoff.

Settings (superadmin)¶

Mobile App¶

See Sentinel App documentation. The app mirrors all dashboard functionality with:

• Biometric authentication (fingerprint / face)
• Push notifications (no Google FCM)
• P2P admin chat (volatile, no DB)
• Visual offline mode (greyscale + red banner)