Skip to content

Air-Gapped Installations

Which plans include it

Air-gapped deployment is part of the Professional edition (on premises). The Community Edition does not include it.

SentriKat can run with no internet access. This page is what changes when it does.

What still works

Everything the product does for you. Agents report, software is matched against the vulnerability data, findings are prioritised, reports and exports are generated. None of that needs the internet: it needs the data, and the data comes in on a file.

The license works too. It is signed offline and valid for its full term, so an installation that never calls home keeps running until the license itself expires.

What changes

Two things stop happening by themselves:

  1. The vulnerability data does not refresh. No feeds are reachable, so what you have is what you last imported.
  2. The license heartbeat does not run. This is not a problem: the heartbeat is a best-effort check, not a permission. Nothing blocks when it cannot run.

Because of the first one, the age of your data becomes something you have to watch rather than something that takes care of itself.

Importing the offline bundle

The bundle is a signed snapshot of the vulnerability data that SentriKat otherwise syncs itself (see Data Sources).

  1. On a machine with internet, download it from the portal, under Downloads
  2. Move it across however you move files into the environment
  3. In SentriKat, go to Settings → Sync & Updates, or straight to /admin-panel#settings:system-sync
  4. At the bottom of that page, below Advanced Maintenance, find the Offline Updates (air-gapped) panel
  5. Choose the bundle file and click Import bundle

Offline Updates panel, below Advanced Maintenance Offline Updates panel, below Advanced Maintenance

If you cannot find the panel

Two things gate it, and neither is air-gapped mode:

  • the installation must be on-premise, not SaaS
  • you must be signed in as a super admin

It is the last panel on the page, below Advanced Maintenance, so on a wide screen it is easy to stop scrolling one panel early. The deep link above opens the right section; #settings:sync does not work.

From 22 October 2026

Downloading offline bundles from the Customer Portal requires a Professional license. Until then every active license can download them, and the portal's Downloads page shows the date.

The bundle is verified against its signature before anything is written. A bundle that has been altered in transit is refused, and nothing is imported.

There is also a command-line route, for environments where the file lands on the server rather than in a browser. The file must be readable from inside the SentriKat container:

docker compose exec sentrikat python scripts/import_feed_bundle.py /path/to/bundle

How often

The bundle is rebuilt daily. How often you carry one across is a decision about how stale you are willing to be.

A practical answer for most installations: weekly, plus an extra one when you hear about something being actively exploited that might affect you.

Checking how old your data is

Settings → Sync & Updates shows the age of each dataset.

This is the screen to look at in an air-gapped installation, because nothing else will tell you. A dataset that is months old still produces findings, and they look exactly like fresh ones: they are simply missing everything published since the last import.

Requirements

A Professional license. The bundle is a licensed download, so without an active license you cannot download new bundles. There is no perpetual license: at expiry the installation returns to Community limits, and nothing is deleted. From 22 October 2026 downloading the bundle from the portal requires a Professional license.

See also