Skip to main content
Sentinel is the analyst in the dashboard, under Monitor. You ask a question in plain English; it answers from your workspace’s own data and shows every query it ran. When a rule would help, it drafts one and asks you before anything is staged.

​
What it answers from

The composer footer states the rule: “Answers are assembled from your org’s own rows. Every figure is traced to the tool calls beneath it.” A tool call here is a query Sentinel runs against your data. The Inspector beside the thread shows that work. In its own words: “Ask a question, and what Sentinel reads to answer it appears here: every query it runs, how many rows came back, and the rows the answer cites.” The Plan tab lists the queries; the evidence tab lists the cited rows. Check the Inspector before you act on a figure.

​
How to ask

Type into the composer, whose placeholder reads “Ask about your fleet — agents, divergences, hosts, risk…”. The attach menu offers Upload image, Upload file and Add page context. Stop halts an answer in progress. Jump to latest returns you to the newest message. Add page context pins what the page beside Sentinel is showing: a session, host, agent or divergence, or the Live activity, Sessions, Agents or Divergences list over a recent window. A pin stores identities only, and Sentinel re-reads them with your permissions when you ask, so the answer uses current data. The reads appear in the answer’s trail. A question carries at most four pins. The item is unavailable on pages with nothing to pin. When uploads are enabled for your workspace, you can attach up to four files to a question by choosing them from the menu, dragging them onto the composer or pasting them. Accepted files are JPEG, PNG, GIF and WebP images up to 3.75 MB each, and text files (txt, csv, json, md, log, yaml) up to 256 KB each, with at most 8 MB in total. Files over a limit are refused before anything is sent. Attachments are sent to the model through AWS Bedrock inside Quint’s AWS account, are not retained by Quint and are not used for training. A follow-up question does not see them, so re-attach a file to ask about it again. If your workspace does not accept pins or uploads yet, Sentinel tells you once and disables those menu items. Conversations sit in the rail on the left. New chat starts one; until then the rail reads “No conversations yet. Your first question starts one.” Conversations are kept 14 days after last use. After an answer, Suggested next questions appear as chips. When Sentinel needs more from you, a card titled “Sentinel needs a few answers” asks. Skip moves on; Something else… lets you type your own.

​
Today’s brief

The Today’s brief card holds a daily read of your workspace. Before the first run it says “No brief has been generated yet.” When the run found nothing: “The brief ran and found nothing to flag across these reads…”. When it did, Investigate opens a thread on it.

​
What it cannot answer

Sentinel reads only retained data. Findings are kept 14 days, events 14 to 45 days and sessions 365 days; the full table is in Workspace and data. It cannot see what no sensor recorded, and it cannot see another workspace. When an answer rests on no query, the Inspector says so: “No tool was called for this answer, so it rests on none of your org’s rows.” Treat that answer as general background, not as a statement about your fleet.

​
From answer to rule

When a rule would help, Sentinel shows a proposal card carrying Review & publish in the rule builder. It opens the normal editor with the draft filled in. Nothing is saved until you publish there, and Sentinel stages nothing on its own. Who may publish rules is in Write and publish a rule.

​
The Canvas rule builder

Rule builder opens beside Sentinel, with the breadcrumb Canvas. Its header reads Draft and “0 rules · not published” until you publish.
  • While the draft is empty, Start from offers What’s active now (“copy the served rules”) or Blank (“start from nothing”).
  • Add a rule adds each rule you want. Check rules checks the set before you publish.
  • Publish… opens the review. Done leaves the builder.
Below the draft, the builder warns: “Add at least one rule — publishing an empty set removes every rule your machines currently hold.” It also says what publishing does: “Publishing opens a review showing what these rules would have matched recently — nothing is saved until you confirm there.”
Every published ruleset starts in shadow mode. Rules record what they match and interrupt nothing until an Admin or Owner arms enforcement; see How policies work.

​
Next