> ## Documentation Index > Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ask Sentinel > What Sentinel answers from, how to ask it, what it cannot answer, and how its drafts reach the rule builder. **Sentinel** is the analyst in the dashboard, under **Monitor**. You ask a question in plain English; it answers from your workspace's own data and shows every query it ran. When a rule would help, it drafts one and asks you before anything is staged. ## What it answers from The composer footer states the rule: "Answers are assembled from your org’s own rows. Every figure is traced to the tool calls beneath it." A tool call here is a query Sentinel runs against your data. The **Inspector** beside the thread shows that work. In its own words: "Ask a question, and what Sentinel reads to answer it appears here: every query it runs, how many rows came back, and the rows the answer cites." The **Plan** tab lists the queries; the evidence tab lists the cited rows. Check the Inspector before you act on a figure. ## How to ask Type into the composer, whose placeholder reads "Ask about your fleet — agents, divergences, hosts, risk…". The attach menu offers **Upload image**, **Upload file** and **Add page context**. **Stop** halts an answer in progress. **Jump to latest** returns you to the newest message. **Add page context** pins what the page beside Sentinel is showing: a session, host, agent or divergence, or the Live activity, Sessions, Agents or Divergences list over a recent window. A pin stores identities only, and Sentinel re-reads them with your permissions when you ask, so the answer uses current data. The reads appear in the answer's trail. A question carries at most four pins. The item is unavailable on pages with nothing to pin. When uploads are enabled for your workspace, you can attach up to four files to a question by choosing them from the menu, dragging them onto the composer or pasting them. Accepted files are JPEG, PNG, GIF and WebP images up to 3.75 MB each, and text files (txt, csv, json, md, log, yaml) up to 256 KB each, with at most 8 MB in total. Files over a limit are refused before anything is sent. Attachments are sent to the model through AWS Bedrock inside Quint's AWS account, are not retained by Quint and are not used for training. A follow-up question does not see them, so re-attach a file to ask about it again. If your workspace does not accept pins or uploads yet, Sentinel tells you once and disables those menu items. Conversations sit in the rail on the left. **New chat** starts one; until then the rail reads "No conversations yet. Your first question starts one." Conversations are kept 14 days after last use. After an answer, **Suggested next questions** appear as chips. When Sentinel needs more from you, a card titled "Sentinel needs a few answers" asks. **Skip** moves on; **Something else…** lets you type your own. ## Today's brief The **Today’s brief** card holds a daily read of your workspace. Before the first run it says "No brief has been generated yet." When the run found nothing: "The brief ran and found nothing to flag across these reads…". When it did, **Investigate** opens a thread on it. ## What it cannot answer Sentinel reads only retained data. Findings are kept 14 days, events 14 to 45 days and sessions 365 days; the full table is in [Workspace and data](https://docs.quintai.dev/settings/workspace-and-data.md). It cannot see what no sensor recorded, and it cannot see another workspace. When an answer rests on no query, the Inspector says so: "No tool was called for this answer, so it rests on none of your org’s rows." Treat that answer as general background, not as a statement about your fleet. ## From answer to rule When a rule would help, Sentinel shows a proposal card carrying **Review & publish in the rule builder**. It opens the normal editor with the draft filled in. Nothing is saved until you publish there, and Sentinel stages nothing on its own. Who may publish rules is in [Write and publish a rule](https://docs.quintai.dev/policies/write-and-publish-a-rule.md). ### The Canvas rule builder **Rule builder** opens beside Sentinel, with the breadcrumb **Canvas**. Its header reads **Draft** and "0 rules · not published" until you publish. * While the draft is empty, **Start from** offers **What’s active now** ("copy the served rules") or **Blank** ("start from nothing"). * **Add a rule** adds each rule you want. **Check rules** checks the set before you publish. * **Publish…** opens the review. **Done** leaves the builder. > [!WARNING] > > Below the draft, the builder warns: "Add at least one rule — publishing an empty set removes every rule your machines currently hold." It also says what publishing does: "Publishing opens a review showing what these rules would have matched recently — nothing is saved until you confirm there." Every published ruleset starts in shadow mode. Rules record what they match and interrupt nothing until an Admin or Owner arms enforcement; see [How policies work](https://docs.quintai.dev/policies/how-policies-work.md). ## Next * [Write and publish a rule](https://docs.quintai.dev/policies/write-and-publish-a-rule.md) for the review-and-publish step in full. * [Investigate a finding](https://docs.quintai.dev/dashboard/investigate-a-finding.md): findings and incidents carry **Investigate in Sentinel**. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.