Everything SentinelOps does today.

Audit logging

Administrative actions audited with actor/target/tenant/result.

Multi-tenant RMM

Tenant→Site→Device→User→Alert data model with server-side isolation.

Role-Based Access Control

~150 granular permissions, tenant roles, operator keys.

Alert correlation / root cause

Downstream device-offline incidents are flagged to their offline upstream (dependency map) and their notification suppressed.

Application deployment policies

Required/Optional/Prohibited app policies per scope with live drift detection against reported software.

Automated remediation

Alert→approved-script auto-run with max-attempts, cooldown and escalation; only approved scripts run unattended.

Automation workflow builder

Compose scripts into multi-step IF/THEN/WAIT workflows: condition steps guard on live device fields (online/os/patches/health/security posture/status/tag), action steps run a script, open a ticket, raise an alert or set operational status, and wait steps pause between them. Triggers are manual, scheduled (hourly/daily/weekly), or alert-driven, and every run is recorded with a per-step log.

Device/software/hardware inventory

File manager

Browse/transfer within authorized roots, audited.

Maintenance windows

Per-tenant scheduled maintenance windows gate disruptive jobs (createJob returns OUTSIDE_MAINTENANCE_WINDOW; override audited).

On-demand device refresh + auto-update

A device's inventory (IP/hostname/hardware) self-updates every heartbeat; an 'Update now' button forces an immediate re-report. IP/hostname changes are logged to the timeline (device.info_changed old→new).

Patch management

Scan/apply, rings, schedules, dashboard; Microsoft Update superset + upgrade labeling.

Per-device patch policy

Set-and-forget per-device patch handling from the device drawer: All updates (default), Security only (any deployment is narrowed to security updates — for appliances updated by their own updater, e.g. XOA), or Excluded (never auto-patched). Applied at dispatch time, so it protects a device across every deployment/schedule.

Reboot management

Pending-reboot, schedule, WoL-aware.

Remote desktop/control

Screen view + input inside a consented, audited session.

Remote registry editor (Windows)

Safe remote regedit: browse/search/edit/replace + global fan-out, backup-before-write, protected-path guard, RBAC+audit. Verified end-to-end on a live Windows endpoint (typed read, write round-trip, key delete).

Remote screenshot

On-demand device screenshot, consent-gated + audited.

Remote terminal

Interactive multi-shell terminal.

Saved filters/views

Scheduled shutdown

Device 'Shut down' quick action: power off now or schedule for a date/time, with cancel; monitor fires it once the device is online. command.execute-gated + audited, respects the maintenance lock.

Script approval workflow

Draft→Review→Approved lifecycle on script templates; unapproved scripts blocked from running (execute-unapproved override) with author self-approval prevented.

Script library

Multi-interpreter; version history/approval pending.

Software management + deployment

Library + multi-scope deploy + a fleet software catalog (title → device-count + versions) from reported inventory.

Technician session recording

Records remote sessions per policy.

Unified alerting & incident engine

Deduped incidents from pluggable periodic sources (monitor cpu/mem/disk, service-state, certificates, monitored-logon, endpoint security-posture) with correlation + multi-channel routing.

Active Directory monitoring

Live AD view: domain/forest identity + functional levels, DC list, FSMO roles, user/group/computer/OU counts, password policy, privileged-group membership (ad.inventory), plus dcdiag/replication/DNS/FSMO health. Populated from a real DC.

Agentless hypervisor security

Network-side security assessment of hypervisors that can't run the agent (XCP-ng/Proxmox/ESXi): exposed management ports, TLS posture of the management UI/API, self-signed/expired/weak-TLS flags. Deep version/CVE lookups (credentialed) are a follow-up.

Antivirus / EDR inventory

AV/EDR product+state inventory (Defender/CrowdStrike/SentinelOne/Carbon Black/ClamAV/Trend) with a no-AV risk view.

Break-glass access

Pre-authorized emergency self-activation, short-TTL, reason-required, heavily audited.

Certificate management

Watch-list + expiry alerts; auto-discovery + TLS scan pending.

Compliance framework + evidence

CIS/NIST/HIPAA/PCI control catalog with per-tenant assessment and honest coverage scoring.

Configuration baselines

CIS-style live checks (reboot/patches/backup/disk now; encryption/firewall/TPM/AV honest not-assessed until agent posture).

Configuration drift detection

Per-device baseline checks (config_baselines) evaluate pass/fail/not-assessed across the fleet with a failing-device rollup + config-change journal.

Device encryption dashboard

BitLocker/FileVault/LUKS fleet dashboard with per-dimension risk drill-down; agent reports posture in hourly inventory.

Device isolation

Quarantine a device to management-only traffic.

DNS monitoring

Server-resolved A/AAAA/MX/TXT/NS/CNAME watch with hourly re-check and change timeline.

Endpoint firewall status

Host firewall (ufw/firewalld/nftables/Windows/macOS ALF) fleet status with a click-to-filter dashboard.

File integrity monitoring

Watched-path policy over the agent tamper-evident (hash-chained) file-audit log: declare critical paths; changes are captured non-repudiably and surfaced.

Identity security dashboard

MFA gaps (weighted for privileged), dormant/locked/never-signed-in accounts, stale passwords.

Just-in-time admin access

Time-boxed elevation, approver-granted, merged into the identity live and auto-expiring.

Litigation hold

Matter→Hold→Resource, WORM collection.

Local administrator management (LAPS)

Rotated vaulted admin password, JIT reveal.

Offline CVE vulnerability scanner

Real installed-package vulnerability scanning independent of patch availability: the server syncs the OSV per-ecosystem databases + CISA KEV to a LOCAL index (only the sync is outbound; scans are offline) and matches each machine's agent-reported installed software against it with dpkg-correct version comparison (unit-tested). Linux distro packages are matched accurately; Windows third-party apps need the credentialed NVD/CPE follow-up.

Password/secret vault integration

Internal vaulting via credentialCipher (all SNMP/deploy/BMC secrets sealed) + LAPS rotated local-admin passwords with JIT reveal; external vault connectors integration-required.

Risk register

Per-tenant risks with severity/likelihood/impact/owner/mitigation; feeds QBR.

Secure Boot / TPM dashboard

TPM/Secure-Enclave + Secure Boot (mokutil/efivars, Confirm-SecureBootUEFI, Apple Silicon) collected and dashboarded with drill-down.

Security exceptions

Documented deviations with owner/approver/expiry; expired ones flagged.

Security hub + dashboard

One Security section in the nav gathering IP-blocking/SSH, vulnerabilities, posture, endpoint/identity security, FIM, baselines, TLS and DNS, plus a rollup Security Dashboard (active blocks, would-block candidates, open CVEs by severity, posture, hypervisor coverage), each card deep-linking to its rules.

Security operations dashboard

Aggregated posture: risks, exceptions, compliance, live elevations, patch/health/firmware.

SSH access guard (monitor/enforce)

The auto-block engine now covers SSH failed-logins with a monitor-only mode (report what WOULD block before enforcing), Sites & Networks CIDRs auto-allowed, and a 'Block now' to promote a monitor-only candidate.

SSL/TLS security scanner

Server-side handshake: protocol/cipher/cert + deprecated-TLS probe, graded, with history.

SSO + 2FA

OIDC/SCIM/WebAuthn/TOTP.

Threat response actions

One-click audited responses: network isolate/release, kill process, decommission, and LAPS credential rotation — usable from a device or an alert.

Vulnerability management

CVE-centric fleet exposure dashboard from patch data: affected-device counts, max severity, known-exploited-in-the-wild first.

Application monitoring (SQL/IIS/etc)

Synthetic app-aware checks: HTTP(S) status+body-keyword for web apps/IIS/nginx, and TCP for SQL/Postgres/MySQL/SMTP/Redis/etc; scheduled with uptime history.

Backup monitoring

Per-endpoint backup posture (agent heartbeat or POST /v1/devices/{id}/backup-status) with a Backups console view + dashboard panel classifying failed/overdue/unprotected/not-reporting (never assumed protected), a DB-configurable per-tenant overdue window + alert toggle, and a background sweep raising incidents for failed/overdue backups; third-party vendor connectors integration-required.

Backup restore verification

Tracks test-restore verification per protected device; flags never-verified and stale (>30d) backups.

Database monitoring & read-only console

First-class Databases module: scheduled liveness+version+metrics and a guarded READ-ONLY query console (SELECT/SHOW/EXPLAIN only) over MySQL/MariaDB, PostgreSQL, MSSQL, Redis and MongoDB (vaulted creds, agent-run, password never on the command line); plus reachability+version monitoring for Oracle, Db2, Elasticsearch/OpenSearch, InfluxDB, CouchDB, etcd, Neo4j, Firebird, SQLite, DuckDB and H2. Alerts on a database going down.

Firewall management dashboard

Register firewalls (per vendor) + live health: TCP reachability/latency + SNMP model/uptime/interface-up-down/CPU. Deep rule mgmt is per-vendor 'integration required'.

Firmware/BIOS management

Detect + gated flash (Dell/fwupd/HP/Lenovo) + auto-snapshot.

Hypervisor guest-IP reveal + reconnect

Discovers a VM's real current IP from its hypervisor (XCP-ng guest tools) even when the agent is offline, and auto-authorizes newly-discovered device IPs on the agent firewall so a moved agent reconnects and self-reports without manual edits.

Hypervisor host monitoring

Live host health (CPU, memory, storage, temperature) for any registered hypervisor: XCP-ng via XenAPI+RRD, Proxmox via the node status API, Hyper-V/VirtualBox via the host's own SentinelOps agent; vCenter host inventory + connection/power state via REST (live perf counters pending SOAP). GET /v1/hypervisor-hosts/{id}/metrics with a Metrics view on every host.

Hypervisor management

VM lifecycle across every provider: list, power (on/off/reset/shutdown), create-from-template, delete and snapshots (list/create/delete/revert). XCP-ng via XenAPI (richest — also disks, NICs, console, ISO mount, boot order); Proxmox via its REST API; vSphere/vCenter via REST (snapshots pending its REST support); Hyper-V and VirtualBox through the host's own SentinelOps agent (Get-VM/Checkpoint-VM, VBoxManage). One console surface drives them all.

IP address management

Subnet/IP allocation over recorded networks, reconciled against discovery, with duplicate detection.

IP-address conflict detection

Automatic — flags two managed devices sharing an IP (server scan) and a conflict with an UNMANAGED host (agent-side ARP/DAD probe: arping on Linux, Windows Tcpip 4198/4199 events). Drawer banners + deduped alerts; stale/offline IPs never false-positive.

Linux log intelligence

Recent-log error/warning counts per Linux endpoint (journalctl, last hour) surfaced in the endpoint-ops rollup.

Network diagrams

Live map; historical topology pending (#22).

Network performance monitoring

SNMP interface telemetry (in/out octets, errors, discards, oper-status) with a fleet dashboard, and an alert source that pages on any interface reported down or a rising interface error/discard rate — covering both agent host-MIB reports and polled SNMP targets.

Network scanning + fingerprinting

RFC1918 sweep, SNMP/OUI/banner fingerprint, pivot.

Network topology history

12-hourly snapshots of each tenant network shape (devices/online/discovered/gateways) retained for trend analysis.

Printer management

Installed-printer inventory per endpoint (CUPS lpstat / Windows Get-Printer) rolled up across the fleet.

Profile restore-to-endpoint

Push a previously-captured profile/config archive back onto a live endpoint — selectable profiles/folders, a collision policy (skip/overwrite/rename), and a dry-run that reports what would change without writing. Gated file.restore + two-person approval; the archive is decrypted server-side and streamed to the agent over the existing chunked transport.

SNMP monitoring + workbench

Storage monitoring (SAN/NAS/RAID/ZFS)

Per-endpoint disk/RAID/ZFS health + near-full filesystem detection from the agent (df, zpool, mdstat, Get-PhysicalDisk); dedicated SAN/NAS SNMP profiles integration-required.

Switch port mapping

SNMP walk (IF-MIB + dot1d/dot1q FDB + LLDP) building port→MAC→device, correlated to enrolled+discovered devices; reuses per-tenant SNMP targets.

UPS / power monitoring

SNMP UPS/PDU (APC/generic).

User profile backup

On-demand or scheduled per-user profile/home backup on a live endpoint (Windows VSS-aware, macOS dscl-resolved, Linux home) into a format-selectable archive (zip/tar/tar.gz), downloadable with at-rest passphrase encryption and one-tap save to Nextcloud/Files from the web console and mobile apps; feeds BackupStatus so a completed profile backup counts toward backup posture.

VPN monitoring

WireGuard site tunnels monitored (gateway up/down, last handshake); third-party VPN client monitoring requires a collector.

Wake-on-LAN (auto-enable on install)

Cross-platform NIC WoL, auto-enabled on enrollment.

Website / port / synthetic monitoring

HTTP(S) status+keyword synthetic checks (App Monitoring) and TCP port/WAN reachability with uptime history.

Windows event intelligence

Recent System-log error/critical counts per Windows endpoint (Get-WinEvent, last hour) surfaced in the endpoint-ops rollup.

Agent health monitoring

Fleet connectivity + agent-version currency rollup (online/stale/behind) with a needs-attention list.

Agent update management

Self-update (adaptive cadence) + in-place rebuild + one-click force-rollout (agent.update job, optional WoL wake); channels pending.

Audit log integrity

SHA-256 hash chain over every audit entry; a verify endpoint proves no retained entry was altered or reordered (pruning-safe).

Backup SentinelOps itself + DR

Whole-server state snapshot download for off-box DR (sealed secrets stay ciphertext); restore by placing it at the state path.

Bandwidth throttling

Per-tenant download cap (KB/s) pushed via heartbeat; the agent enforces it on large transfers (self-update channel) with a rate-limited read loop — control traffic uncapped.

Bulk actions

Run a maintenance action (scan/patch/restart/update/audit/firmware) across many devices at once, each gated by the same job permission/approval.

Command palette

Cmd/Ctrl-K quick-nav + entity jump over the global search backend.

Data retention policies

Per-tenant retention (audit + finished-job days) enforced by an hourly prune loop; 0 = keep indefinitely.

Device decommission workflow

One-click decommission: revoke the agent credential, mark decommissioned + lifecycle, audited; reversible only by re-enroll.

Discovery approval queue

Triage unmanaged discovered hosts — approve for deployment or dismiss; the queue drops reviewed/ignored hosts.

High availability

Two modes: (1) peer warm-standby — copy the install to a second machine, point it at the primary (SENTINELOPS_HA_ROLE=standby, _HA_PRIMARY_URL), it gets its own node id, syncs the primary's full state every ~15s and defers all singleton loops until POST /v1/ha/promote; (2) active-active scale-out — several stateless instances share one SQL database (SENTINELOPS_DATABASE_URL: Postgres/MySQL/MSSQL) coordinated by a cross-server advisory lock (consistentHandler), for more concurrent connections behind a load balancer. GET /v1/ha/status, GET /v1/ha/snapshot. Client failover (DNS/VIP) is an infra choice.

Integration framework

Plugin framework (console/integration/automation/agent types) with manifest validation, enable/config, and tenant scope.

Job dashboard

Fleet-wide job feed with status counts + click-to-filter over all device jobs.

Message queue

Cross-instance event fan-out for active-active clusters. Every state change is appended to a shared event table and every instance tails it, so a WebSocket/SSE client on one instance receives events published by any other. On PostgreSQL this is push-based: each append issues NOTIFY and each instance holds a dedicated LISTEN connection, delivering in milliseconds while the periodic poll drops to a 3s backstop; MySQL/SQL Server use the poller alone. Falls back to purely local delivery on the single-instance file backend. No external broker to run.

Multi-site gateway/relay

WireGuard site gateway: a foothold agent advertises its LAN to the hub, giving per-tenant routed reach into client networks.

Notification center + rules

Console-managed destinations (ntfy/Slack/Discord/raw) with per-destination min-severity AND event-type routing rules; per-operator email/SMS/browser prefs.

Offline job queue

Queued jobs with expiry.

On-call escalation + business hours

Per-tenant tiered escalation ladder + business-hours window; a sweep advances unacked incidents through the tiers.

Outbound webhooks

HMAC-signed incident webhooks (env-configured + console-managed destinations) with per-destination min-severity and event-type routing rules.

Peer caching

Designate a site cache peer; it runs a LAN HTTP cache and co-located agents (matched by /24) pull artifacts (agent self-updates) from the peer first, SHA-256-verified, falling back to the server. Download-once-per-site.

Public API platform

Documented /v1 REST API authenticated by operator API keys with full RBAC + per-IP rate limiting; the console itself runs on it.

Rogue device detection

Unmanaged devices on client networks from discovery, flagged (randomized MAC etc.) with acknowledge.

Search everywhere

One query across devices, tickets, contacts, vendors, changes, risks, DNS/TLS, docs, sites/networks.

Tenant offboarding + export

Portable per-tenant JSON export (devices/tickets/sites/incidents, credentials stripped) + confirmed offboard that revokes+decommissions every device.

Approval engine

Two-person approval on impactful jobs (command/script/patch/service) + per-tenant change-management gate; author self-approval prevented.

Asset lifecycle management

Per-device asset record (purchase/warranty/supplier/cost/user/location) + lifecycle status.

Change management

Standard/normal/emergency change records with risk, approval, window and rollback plan.

Customer contact management

Tenant contacts with types + escalation order.

Dependency mapping

Operator-defined device dependencies (network/power/service/app) with an impact primitive for correlation.

Documentation module

Tenant docs by section + auto-populate a Network page from inventory (#43).

Geographic site mapping

Tenant→Site→Network with timezone.

ISP/WAN monitoring

Server-side TCP reachability + latency probing of a client's WAN endpoint with uptime history.

Native ticketing

First-class service desk with lifecycle, priority, assignee, device link and comment thread.

Site dashboard

Per-site rollup of devices, connectivity (online/offline) and open alerts across every location.

SLA tracking

Per-priority response/resolution targets scored live against imported tickets.

Ticketing system integration

Native ticketing + alert→ticket auto-creation (per-tenant, by severity); incidents route to any external PSA via the signed webhook (native connectors integration-required).

Vendor management

Tenant vendors; account id sealed + reveal-gated.

Warranty tracking

Fleet warranty rollup, soonest-expiry first, expiring<90d flagged.

AI operations assistant

In-console ✨ assistant (chat panel + FAB, view-aware): answers questions about what you're looking at and drafts monitor rules / scripts you review and apply. Needs the AI add-on enabled and a valid provider API key set in AI settings; honest when unconfigured.

AI root cause analysis

Assistant analyses an incident with its timeline, dependency root-cause and recent changes; honest when unconfigured.

AI troubleshooting timeline

Assistant narrates a device's unified timeline + health into a troubleshooting story; honest when unconfigured.

Capacity planning

Persisted hourly disk/mem history + least-squares disk-full projection; honest 'collecting' until enough data.

Custom dashboard builder

Per-operator dashboards of KPI widgets bound to whitelisted server-computed metrics.

Device health score

0–100 from patch/disk/reboot/backup/reachability with reasons.

Hardware change detection

Baselines board/serial/uuid/RAM per device and records swaps to the timeline and security view.

QBR / vCIO reporting

Provider engine, coverage-honest scoring, exports.

Recommendation engine + tracking

A standing, severity-ranked 'next best actions' feed derived live from real signals (encryption/firewall/AV posture, critical patches, warranty expiry, restore-verification, device health, TLS grade, privileged-account MFA, unused M365 seats) with a persisted acknowledge/dismiss lifecycle that auto-resolves when a condition clears.

Report builder + scheduled reports

Recurring emailed fleet-summary reports (daily/weekly, per-recipient) with an hourly delivery loop over the working SMTP relay.

Tenant health score

Average of device scores, retired assets excluded; GET /v1/health.

Unified device timeline

One chronological feed per device merging audit, alerts, jobs and patch touches.

Cost optimization

Unused M365 seats (priced), retired-but-enrolled devices, and warranty renewals due — honest when a source isn't connected.

MDM integration (Intune/ABM)

Intune (Microsoft Endpoint Manager) enrolled devices, compliance and per-device actions (sync/lock/reboot/retire/wipe) via the tenant's existing Microsoft Graph app — needs the DeviceManagementManagedDevices scope consented. Apple Business Manager = a vaulted-credential connector that renders 'integration required' until ABM API creds are added (a full Apple MDM enrollment server is out of scope; Apple endpoints are managed via the SentinelOps agent).

Microsoft 365 / Entra

Billing/licensing, own-tenant, and a security posture view: Conditional Access coverage (enforced vs report-only), MFA-registration coverage (incl. admins without MFA), and Identity Protection risky users — each pulled by the Graph sync and, when a dataset's admin-consent scope is not granted, surfaced as the exact scope to add rather than a fabricated all-clear.

Domain Controller diagnostics

Automated dcdiag + repadmin replication + DNS tests + FSMO on managed DCs, scheduled re-checks, failures feed the alert engine. Verified live against a real DC (DC01).

Domain portfolio + expiry

Per-tenant internet-domain portfolio (multiple domains/subdomains): RDAP registration expiry, registrar, nameservers, hold/DNSSEC status + DNS health, daily rechecks, expiry alerts, and 365 verified-domain cross-reference when Graph is connected.

Group Policy delivery verification

Per-endpoint gpresult (which GPOs actually applied, last apply time, errors) collected by the agent as SYSTEM via /scope:computer, with a fleet rollup and a target-GPO check that proves a specific policy reached every machine it should. Endpoint-side, no DC access needed.

Intune/365 delivery verification

Two sources: per-endpoint IME state (agent-reported enrollment/last-sync/app states) AND the authoritative tenant-wide picture from Microsoft Graph when connected — managed-device count, compliance breakdown, recently-synced, and which Intune devices are also under SentinelOps management (reconciled by name). Honest 'connect Graph' when the 365/Entra connector isn't set.