Frequently Asked Questions¶

General¶

What is SentriKat?¶

SentriKat is a vulnerability management platform that tracks your software inventory and matches it against the catalogue of vulnerabilities confirmed as exploited and exploit-probability scoring data. It helps you identify which of your systems are affected by actively exploited vulnerabilities and prioritize remediation.

What editions are available?¶

SentriKat is available in two deployment models:

SaaS Plans (hosted at app.sentrikat.com):

On-Premises Editions:

• Community: Free, up to 10 agents and 3 users, for evaluation and small teams
• Professional: €4,999/year, 10 agents included (more with agent packs). The Compliance Pack (DORA, PCI-DSS, ISO 27001, SOC 2 reports) is a paid add-on

See the pricing page for what each plan and edition includes.

How is SentriKat deployed?¶

SentriKat is available as a fully managed SaaS or as an on-premises deployment:

• SaaS: Sign up at sentrikat.com and log in at app.sentrikat.com. No installation required. Deploy agents to your endpoints and view the results.
• On-Premises: Download the release package from the Customer Portal, configure your environment, and run it with Docker Compose.

See the Getting Started guide for both options.

What are the system requirements?¶

SaaS: No server infrastructure needed, just deploy agents to your endpoints. Agents are lightweight and run on Windows, Linux, and macOS.

On-Premises:

• Minimum: 2 CPU cores, 4 GB RAM, 20 GB SSD
• Recommended: 4 CPU cores, 8 GB RAM, 50 GB SSD
• Software: Docker 20.10+ and Docker Compose v2
• Network: Outbound HTTPS for the vulnerability feeds, the software identity catalogue, and license validation

The 4 GB RAM minimum accounts for the application, PostgreSQL, and the full software identity catalogue.

Licensing¶

How do I get a license?¶

SaaS: No license key needed. Sign up at sentrikat.com, log in at app.sentrikat.com, and your subscription is managed through your account. Upgrade plans from account settings at any time.

On-Premises:

1. Get the free Community Edition at sentrikat.com, or buy Professional (€4,999/year) in the Customer Portal or through our sales team at [email protected]
2. Receive your activation code (SK-XXXX-XXXX-XXXX-XXXX) via email. The Community welcome email carries it together with the license key, and the portal shows it too and can issue a new one
3. Activate online from Settings → License, or set the signed license key in your .env file as SENTRIKAT_LICENSE

See the Licensing guide for full details.

Can I switch from Community Edition to Professional?¶

SaaS: Upgrade your plan directly from account settings at app.sentrikat.com. Changes take effect immediately.

On-Premises: Contact sales@sentrikat.com for a Professional license key. Activate it in Settings → License, or set it as SENTRIKAT_LICENSE in your .env file and apply it with docker compose up -d (docker compose restart does not reread .env). No data is lost during the upgrade.

What happens when my license expires?¶

When a Pro license expires, SentriKat continues in Community Edition with its limits and features. Vulnerability data keeps syncing and matching, so you do not lose sight of what is already installed. Pro features are closed to everyone except the administrator of the installation, including scheduled reports. Nothing is deleted. Renew from the Customer Portal, then apply the new license in Settings → License, and Pro comes back.

Can I transfer my license to a different server?¶

Yes. In the Customer Portal, open Downloads and use Rebind to new server, entering the new Installation ID. The previous installation is deactivated. See Backup & Restore for moving the data.

Agents¶

Which platforms are supported?¶

SentriKat provides native agents for:

• Windows 10/11 and Windows Server 2016+ (Windows Agent guide)
• Linux (Debian, Ubuntu, RHEL, CentOS, Alpine, etc.) (Linux Agent guide)
• macOS 12 Monterey and later (macOS Agent guide)
• Container images (Docker and Podman, scanned automatically when detected) (Container Scanning guide)

Additionally, SentriKat integrates with Lansweeper for environments that already use it for asset management.

Agents collect installed software (Windows products, Linux packages, macOS applications) and scan container images in a single pass. For other platforms, use the REST API Import to submit inventory from any system.

How often do agents scan?¶

By default, agents scan every 4 hours. You can configure the scan interval in the agent configuration file. See the individual agent guides for details.

Do agents collect personal data?¶

Agents report the installed software (names, versions and vendors) and the identity of the machine it runs on, such as its hostname, so that findings can be shown per endpoint. That can include personal data if hostnames identify people. Agents do not collect file contents, user activity, browsing history, or credentials.

Can I deploy agents via Group Policy or Intune?¶

Yes. See the PDQ Deploy and SCCM/Intune integration guides for enterprise deployment methods.

Vulnerabilities¶

Where does vulnerability data come from?¶

SentriKat uses multiple data sources:

• Exploited-vulnerability catalogue: vulnerabilities confirmed as exploited in the wild
• Exploit probability: probability-based prioritization
• Software identity catalogue: vendor/product entries for accurate software identification
• Vendor Advisories: Red Hat, Microsoft MSRC, Debian Security Tracker, package advisories
• Community Knowledge Base: Professional installations share human-verified CPE mappings

The vulnerability feeds sync daily. The software identity catalogue refreshes every 7 days. Vendor advisories sync daily.

How does SentriKat match vulnerabilities?¶

SentriKat matches your software inventory against CVE data using CPE (Common Platform Enumeration) identifiers. Products imported with a CPE are matched directly. Products without a CPE are matched using fuzzy name and vendor matching.

What does "Priority" mean vs. "Severity"?¶

• Severity is the standard CVSS score (critical, high, medium, low)
• Priority is SentriKat's calculated priority that factors in exploit probability, confirmed exploitation, ransomware usage, and your product criticality settings

Priority gives you a more actionable view of what to fix first.

How do I handle false positives?¶

Mark the vulnerability as "False Positive" in the vulnerability detail view. This removes it from active counts while preserving the audit trail. You can also add notes explaining why it's a false positive.

Exploited-vulnerability catalogue¶

What is the exploited-vulnerability catalogue?¶

The catalogue lists CVEs that are confirmed to be actively exploited in the wild. Organizations subject to BOD 22-01 are required to remediate entries in the exploited-vulnerability catalogue by their due dates.

How often is the exploited-vulnerability catalogue updated?¶

The exploited-vulnerability catalogue is updated as new exploited vulnerabilities are confirmed. SentriKat syncs daily by default, or you can trigger a manual sync from Settings → Sync & Updates.

What is the "ransomware" flag?¶

Some entries in the exploited-vulnerability catalogue are flagged as "Known to be Used in Ransomware Campaigns." SentriKat highlights these with a special indicator so you can prioritize them accordingly.

Troubleshooting¶

SentriKat won't start¶

1. Check that Docker and Docker Compose are installed and running
2. Verify your .env file has all required variables (SECRET_KEY, ENCRYPTION_KEY, DB_PASSWORD, …). See Configuration
3. Check container logs: docker compose logs sentrikat
4. Ensure ports are not in use by another service

Agent is not reporting¶

1. Verify the agent service is running on the target machine
2. Check network connectivity to your SentriKat instance: app.sentrikat.com for SaaS, or your self-hosted URL for on-premises (HTTPS port 443)
3. Confirm the API key is valid in Agents → Agent Keys
4. Review agent logs for errors

Exploited-vulnerability sync shows no new matches¶

This is normal if none of your software products are affected by new entries in the exploited-vulnerability catalogue. Check Settings → Sync & Updates for sync status and history. If you recently added new products, trigger a manual sync.

What is the Community Knowledge Base (KB)?¶

The Knowledge Base is a shared CPE mapping database that improves vulnerability matching accuracy over time. When a Professional installation discovers a new vendor/product → CPE mapping, it can push the mapping to the central KB. Once 3 or more independent installations confirm the same mapping, it is automatically published and available to all users on the next pull.

The KB also includes the complete software identity catalogue.

Do I need to configure the KB?¶

No. Knowledge-base synchronization runs automatically in every edition that is not air-gapped, every 12 hours: the installation downloads the published mappings and sends the mappings it has learned and the names of software it could not identify. The license service stores the mappings only from Professional licenses. Each part has a switch: SENTRIKAT_KB_SHARE_MAPPINGS=false stops the mappings from being sent, the switch in the interface or SENTRIKAT_MAPPING_CONTRIBUTIONS=false stops the software names, and SENTRIKAT_KB_SYNC_ENABLED=false turns off the mappings and the download, not the software names. What is sent, and every switch, is listed on What SentriKat sends home. You can also browse the KB in the admin panel under KB Mappings.

Compliance & Reporting¶

Does SentriKat support NIS2 compliance?¶

SentriKat produces NIS2 Article 21 reports that map your vulnerability management activities to NIS2 requirements. They are evidence of what you did, not a certification: being compliant remains your organization's responsibility. NIS2 reports are available on Professional (on premises) and on Cloud Pro and above. See the Compliance Reports guide.

What reports are available?¶

• NIS2 Article 21: mapping to the NIS2 requirements (Professional, Cloud Pro and above)
• BOD 22-01: remediation deadline tracking for exploited vulnerabilities (Professional, Cloud Pro and above)
• Compliance Pack reports: DORA, PCI-DSS v4.0, ISO/IEC 27001:2022 and SOC 2. A paid add-on on Cloud and on premises; Professional alone does not include it. During Early Access every Cloud plan includes it
• Executive Summary PDF: Risk scores, KPIs, and trends for management
• CSV/Excel Export: Raw vulnerability and product data

All reports can be generated on-demand or scheduled for automatic delivery.

Can SentriKat forward events to my SIEM?¶

Yes, on Professional (on premises) and Cloud Pro and above. SentriKat supports syslog forwarding in CEF, JSON, and RFC 5424 formats, for Splunk, Elastic/ELK, ArcSight, and QRadar. See the SIEM Integration guide.

Does SentriKat integrate with issue trackers?¶

Yes, on Professional (on premises) and Cloud Pro and above. SentriKat can automatically create issues in Jira, GitHub Issues, and GitLab Issues (and YouTrack on Cloud) when vulnerabilities are detected. See the Issue Trackers guide.

Can SentriKat run in an air-gapped environment?¶

Yes, on Professional. In air-gapped mode, the vulnerability data and the software identity catalogue can be imported via offline bundles instead of syncing over the internet. See the Air-Gapped Installations guide.

Support¶

How do I get support?¶

• SaaS Starter: email, at support@sentrikat.com
• SaaS Pro: email, answered within one business day
• SaaS Business: email, plus scheduled calls
• SaaS Enterprise: the support agreement in your contract
• On-premises: email and tickets through the Customer Portal
• All users: Visit the community forum for community-driven help and discussions