sentry hub

These bans are delivered to every agent on check-in and enforced in each agent's nftables. Removing one un-blocks it fleet-wide on the next check-in.

Every agent's samples on one timeline. Agents do not share sample timestamps, so points are bucketed before they are summed — adding them raw would chart check-in jitter rather than traffic.

Busiest first. Open a host to see only its traffic, its rules and its bans.

Every agent reports the addresses it has banned. This is the fleet roll-up: one row per address, showing which hosts independently found it. An address several edges banned on their own is a far stronger signal than one a single host saw once — those are the right candidates to promote to the Global Blocklist.

Ban volume alone only says a host is noisy. Paired with the domains that host actually serves, it says what is under attack. Only here counts addresses no other host has seen — that separates a campaign aimed at this host from the internet background noise every edge sees.

Every question the fleet answered, and every zone transfer in both directions. Kept in a ring separate from the security event log, so ordinary query volume can never push a sinkhole or a refused transfer out of the record. Outbound rows are the AXFR an agent performs as a secondary, pulling a zone from its primary every refresh cycle — in this estate those are the transfers that actually happen, and they were invisible until now because only inbound transfer requests were ever recorded.

Must match the console's public domain exactly for passkeys to work.

Outbound email for password-reset links (STARTTLS, port 587).

Turn a directory group into a hub role. While the switch below is off nothing changes — the stored role keeps governing, exactly as today. You can fill this in and use Test before committing to it.

Leaving “no rule matches” blank denies the login. That is deliberate: a user whose groups you have not accounted for should not quietly inherit a role.

Read group membership straight from the domain. The service account only needs read access — this never writes to the directory. Ships switched off; use Test lookup to prove the filter and the rules against the real directory before activating.

Country, owning network (ASN) and enclosing netblock for every address in the console. Looked up locally from a database the hub holds, so no address is ever sent to a third party and nothing tips off the source you are investigating.

For a hub with no outbound access. Take dbip-country-lite-YYYY-MM.mmdb.gz and dbip-asn-lite-YYYY-MM.mmdb.gz from db-ip.com and upload each here; either the .gz or the unpacked .mmdb is accepted.

IP geolocation by DB-IP, used under CC BY 4.0.

Declare which host/domain accepts which traffic type — this ties the Proxy, Streams, and DNS tabs together so the operator states intent (e.g. app.example.com = http-proxy, mail.example.com = L4-stream, ns1.example.com = dns). Inventory + intent; enforcement lives on the respective tab.

Add a route

Bind failures (privileged port, port in use) are logged by the agent and skip that route only. Ports < 1024 need the agent to run as root / with CAP_NET_BIND_SERVICE.