User Guide¶

Welcome to the SentriKat User Guide. This section covers day-to-day usage of the platform.

Overview¶

SentriKat provides a focused approach to vulnerability management:

1. Dashboard - At-a-glance view of your security posture
2. Products - Manage your software inventory
3. Vulnerabilities - Track and acknowledge CVEs
4. Compliance Reports - NIS2 Article 21, exploited-vulnerability compliance, executive PDFs
5. Alerts & Issue Trackers - Email, webhooks, Jira/GitHub/GitLab/YouTrack

Quick Navigation¶

How it works, end to end¶

Two streams arrive on their own schedule, SentriKat matches them, and what comes out is a list of updates to install.

%%{init: {"flowchart": {"curve": "basis", "nodeSpacing": 30, "rankSpacing": 60, "wrappingWidth": 420}}}%%
flowchart TB
    subgraph feeds["From outside"]
        direction LR
        f1["Exploited vulnerabilities<br/><i>daily</i>"]
        f2["Severity and advisories<br/><i>daily</i>"]
        f3["Exploit probability<br/><i>daily</i>"]
        f4["Software identities<br/><i>weekly</i>"]
    end

    subgraph you["From your estate"]
        direction LR
        a1["Agent inventory<br/><i>every 4 hours</i>"]
        a2["Lockfiles, containers<br/><i>with each report</i>"]
    end

    subgraph match["SentriKat decides"]
        direction TB
        m1["1. Identity<br/>which published software is this?"]
        m2["2. Version<br/>are you on an affected one?<br/>vendor back-ports read too"]
        m3["3. Band<br/>exploited, likely, or later"]
        m1 --> m2 --> m3
    end

    feeds --> match
    you --> match

    m3 --> out1["Dashboard<br/>updates to install, not CVE counts"]
    m3 --> out2["Alerts<br/>email and webhook, per organization"]
    m3 --> out3["Reports and exports<br/>Compliance reports, SBOM, VEX"]

    classDef act stroke:#3e6b8a,stroke-width:2.5px
    class m3 act
    style feeds fill:transparent,stroke:#8b93a3
    style you fill:transparent,stroke:#8b93a3
    style match fill:transparent,stroke:#8b93a3

Nothing in the left column waits for you, and nothing in it is triggered by you. The only cadence you control is how often the agents report, and the default of every four hours is usually the right one.

Step 2 is where most of the accuracy lives. A distribution that back-ports a fix keeps the old version number, so comparing numbers alone would report a patched machine as vulnerable. SentriKat reads the package epoch and release as well, which is why a Debian or Red Hat box does not light up the morning after it was patched.

Key Concepts¶

The exploited-vulnerability catalogue¶

The published catalogue of exploited vulnerabilities contains vulnerabilities that:

• Have a CVE ID
• Have active exploitation in the wild
• Have clear remediation guidance

Bands¶

SentriKat sorts findings into three bands: ACT NOW, PLAN THIS MONTH and BACKGROUND. Confirmed exploitation decides first, severity second. See Dashboard and Vulnerabilities.

Match Confidence¶

When matching products to vulnerabilities: