Find your way around

Operations dashboard

The at-a-glance state of the organization you have selected (or the whole fleet when no tenant is picked). It exists so an operator opens one screen and immediately sees what is enrolled, what is online, what is being attacked, what is out of compliance and what needs patching — instead of hunting through modules. For the tenant it is their live operations picture: a tenant-scoped account sees only its own organization, and every tile and panel links straight to the view that resolves it, so nothing is a dead end.

KPI tiles: Seven live counters, each clickable to the view behind it: Total Endpoints (with "↑ N this week" → Devices), Online Agents (% of total → Devices), Critical Alerts (N open total → Alerts), Patch Compliance (%, with critical·security counts → Patch Management), Active Packages (of N total → Agent Deploy), Scheduled Jobs (enabled of defined → Scheduled Jobs) and Services Up (up/enabled monitors → App Monitoring).
Security & attacks: Brute-force IPs blocked at the host firewall (total and last-24h), active attacks (IDS / brute-force detections), and open critical and warning alerts. The status pill and each metric deep-link to Threat Blocks or Alerts focused on exactly what it counts; a top-origins line summarises where the blocked attackers came from (RDAP country lookup).
Patch status: Compliance percentage plus Critical / Security / Available / Need-reboot / Non-compliant / Unknown counts, and the next scheduled patch run. Each number opens Patch Management pre-filtered to that set. Shown once scan data exists.
Vulnerabilities: Exploited-in-the-wild (CISA KEV), critical and high CVE counts across endpoints from the offline OSV/KEV scanner, with affected and scanned device counts. Each tile opens those findings. Appears once something has been scanned or the offline CVE database is synced.
Domain controllers: One card per detected DC with dcdiag / replication / DNS failure counts and an aggregate healthy/unhealthy pill; click a controller for its diagnostics. Appears only when the tenant actually has a domain controller.
System Performance: CPU, memory and disk charts for the fleet (or one machine, via the selector), drawn from live heartbeat telemetry across reporting endpoints. The chart type is selectable; "Devices →" opens per-machine performance.
Endpoint Distribution: A chart per platform family (and its SNMP/hardware detail), with selectable chart style and columns-per-row — an honest split of the managed fleet by OS.
Application & Service Health: A grid of per-system mini-dashboards (resources + services + alerts), driven live by the app/deep-DB monitors. Controls: trend chart style, how many systems to show (Auto/4/6/8/12/16/24), a "Systems…" picker, and Priority / Issues / All filters. "Monitors →" manages the checks. Thresholds and the auto-high-risk service list are set in Settings.
Log monitoring: Critical and total OS-log alert matches in the last 24h plus active alert and suppression rule counts; each metric opens Log Monitoring. Requires alert.read.
SentinelOps platform health: The platform’s own services — API, database, message queue, alerts, workers, HA and email — with live status; "Open →" goes to High Availability.
Hypervisor hosts: XCP-ng / Proxmox / vSphere / Hyper-V hosts monitored agentlessly, with live CPU / memory / disk / temperature. Appears when hosts are configured.
Backup health: Failed / Overdue / Unprotected / Not-reporting / Protected counts across managed endpoints, with an at-risk headline; "Open →" goes to Backups. Tenant-scoped.
Profile & service backups: Recent profile/service captures with running/captured/failed counts; shown when you hold file.backup and a tenant is selected.
Device Inventory: The first 10 endpoints with OS, status, CPU/RAM/storage bars, last check-in and open-alert count; click a row for the device drawer, "All devices →" for the full grid. device.token.revoke shows an inline Remove.
Alerts rail: The most-severe-then-oldest open incidents; click one to jump to the affected device, "View all" opens Alerts.
Microsoft 365 & Sign-in activity: When configured for the tenant: a Microsoft 365 panel (users, licences, Secure Score, groups, Entra devices) and a Sign-in activity panel (a 24-hour bar graph and recent sign-ins to servers tagged monitor-logons).
SNMP monitoring: A rollup for SNMP-enabled machines; if endpoints are eligible but have not reported yet it says so and why (older agent build), rather than rendering blank.
Configure: The ⚙ Configure button (top right) shows or hides the standard panels for this dashboard (operator.manage; applies to everyone viewing it) and, under "Your custom KPI panels", lets you build your own panels from live metrics and choose which appear here — personal to you, available to any operator. Custom panels sit at the top of the dashboard and update live; "Reset layout" returns every panel to its default position.

Devices — the programmable grid

The central inventory of every managed endpoint, built as a queryable projection rather than a fixed table — you choose the columns, filter with an expression, sort, and save the result as a reusable view. It exists so one screen serves every job, from a quick status glance to a defensible CSV export, and so a single row opens into the full device drawer where every remote action lives. For the tenant it is the single source of truth for their machines, and the launch point for operating any one of them.

Role tabs: All / Servers / Workstations / Mobile filter by the device role, derived from OS and inventory and overridable per device. "Unmanaged" opens network Discovery.
Filter expression: A text query, e.g. "os:linux AND cpu_load_pct > 90" or "NOT tag:decommissioned". Durations like 30d compare age on time columns; versions compare numerically. Press Enter to apply.
Manage columns: Opens the drawer: search 29 columns across Identity, Telemetry, Network, Agent and Security, toggle them on or off, and reorder the shown ones. The same projection backs the API and the CSV export.
Saved views: Save the current columns, filter, sort and density as a private or tenant-wide view. Selecting a view applies all of it.
Sorting & density: Click a header to sort; shift-click to add a secondary sort. The density button cycles comfortable / standard / compact row heights.
Export: Writes the current projection to CSV with a header block recording the filter, count and timestamp, so the file stays defensible evidence.
A device row: Click any row to open the detail drawer: telemetry, jobs, live preview, remote access, files and annotations — and the Quick actions grid below.
Device drawer — Quick actions: The drawer’s action grid is where you operate the machine, each button permission-gated (a limited role sees fewer): Live screen, System info, Update now (force a re-report), Processes, Event log, Local accounts, DNS, Message user, Files, Command, Terminal, Run script, Deploy software, Mount media, Services, Security & activity, Audit & Access, Activity audit, Timeline, System report, Isolate host, Drives, Applications, SNMP, Maintenance lock, Operational status, Wake-on-LAN, Patch this device, Hypervisor power, Scan this segment / Find host & siblings, Wireless scan, Bluetooth (on / off / check, plus “Keep Bluetooth on”, which switches it back on every 2 minutes if it goes off — on macOS the agent needs a one-time approval in Privacy & Security → Bluetooth), Travelling (GeoIP exemption), Local admin (vaulted LAPS), SSH tunnel, Sessions, Reboot, Shut down, Remote session, Restart agent, Back up profile, Move to tenant, Decommission, Remove device, and a per-device Patch policy selector (All updates / Security only / Excluded).
Terminal, Command & Run script: Command runs a single allowlisted command and returns its output. Terminal (needs remote.control; labelled "Terminal (PowerShell / CMD)" on Windows) opens a full interactive xterm.js window with Ctrl-C, a control-key sender, detach-into-its-own-window (⧉) and End session — open several at once (they cascade), and drag-and-drop a file onto it to upload to the shell’s working directory. Run script runs an allowlisted interpreter, second-operator approved. SSH tunnel reaches the endpoint’s own SSH/TCP port through the agent with no open port.
Sessions → working behind the signed-in user: The drawer’s Sessions panel shows who is signed in and lets you work without interrupting them: Backstage tools (terminal, services, files that run without their screen), Run in the user’s profile, and a Second interactive session over the audited tunnel. On client Windows a second desktop logon disconnects the user (an OS limit); on Windows Server it runs alongside them.
Sessions → Concurrent desktop (macOS): On a Mac (Apple silicon, macOS 14+) Enable & connect turns on Screen Sharing and gives you a vnc:// link. Connect from a Mac’s Screen Sharing app and choose "Log in to a virtual display" to get your OWN desktop while the signed-in user keeps working; any other VNC client shadows their screen instead. Needs remote.control and a Mac admin credential vaulted for the device. Turn Screen Sharing off when done.
Retiring a machine (Shut down → Decommission → Remove): These live in the drawer and are permission-gated, so a limited role may not see them. Shut down (needs command.execute) powers the box off now or on a schedule — it keeps running SentinelOps. Decommission (needs device.status.change) marks the device decommissioned: alerts, patching and automation pause, and a removal-protected agent is allowed to deregister — it STAYS in inventory; you confirm by typing the device name. Remove device (red, needs device.token.revoke) deletes it from inventory, revokes its agent token AND deletes everything tied to it — GeoIP / log-alert / monitoring rules aimed only at it (shared rules just drop it), its vaulted LAPS and Mac admin passwords, scans, patch state, metrics, blocked-IP records, firewall grants and IP allocations. Retained on purpose: the audit trail, activity evidence, session recordings, tickets and asset records; BMC and hypervisor entries are kept but unlinked. Irreversible, and refused while a legal hold covers the tenant. SentinelOps also sweeps hourly for anything a machine removed some other way left behind. Typical order: shut down if you want it off, decommission to retire it cleanly (keeps everything), then Remove device to delete the record and its related data.

Groups

Device groups inside an organization — the Tenant → Group → System tree — and who can access them. Groups exist so policy, deployments, access and overrides apply to a set of machines at once instead of one by one, and so engineers’ reach can be ring-fenced to just the groups they manage. For the tenant, a group is the "group" scope used by Self-Healing overrides and maintenance windows, deployments, locks and access grants. Every group belongs to exactly one organization (never global); a sub-group must sit under a parent in the same organization, and a machine can only join a group in its own organization. (User groups — which grant roles to people — are under Administration → Users & Identity → User Groups.)

The tree: Each organization expands to its groups and sub-groups, every node showing its total system count; a running/stopped dot marks each system online/offline. An "Ungrouped" node holds machines in no group. The view scopes to the organization picked in the top bar.
Create / rename / delete: "+ New group" (or a tenant’s own "+ Group") creates a top-level group; "+ Subgroup" nests one under a parent; Rename and Delete manage existing ones. Deleting a group moves its systems to Ungrouped, moves any sub-groups up one level, and removes its rights and its Self-Healing overrides and maintenance window. (All need operator.manage.)
Assign systems: Assign systems chooses which of the organization’s machines belong to the group; a machine is in at most one group.
Locks: The 🔒 Locks button sets a live policy on the group that applies to every current AND future member: Lock commands (no commands, scripts or service actions run on members) and Disable installs (no software installs or patch applies). Reads, screen and inventory are never affected.
Rights: Rights grants or revokes operator access scoped to this group — the ref-counted access control that lets an engineer manage only their groups.

Next: Alerts and Self-Healing →