Security decisions take place close to traffic.
The agent reads events, applies rules and blocks and, when required by deployment, protects web requests before they reach the application.
From installation to blocking: this is what Sentinel does.
Sentinel protects traffic on the server, coordinates agents from a central core and transforms every decision into understandable data. Here you find the complete path, without generic formulas.
Local protectionCentralised controlAuthenticated Channel
Configuration and visibility remain in one place.
The central server receives telemetry, distributes policies and maintains the state of the fleet without becoming the obligatory passage of visitor traffic.
Technical events become verifiable actions.
The dashboard, timeline, reports and alerts show what happened, on which server and what protection made the decision.
The path of a request
A request comes in. Sentinel decides. The application receives only what passes the controls.
The actual flow depends on the modules activated on the server and the mode chosen for each site.
01
Incoming request
The client contacts the domain. In the WAF deployment, the request reaches the local level of protection before the site.
02
Evaluation
OWASP CRS rules, limits, geolocation, reputation and available fingerprints contribute to the decision.
03
Action
The request is forwarded, observed, limited or blocked according to the policy applied to that domain.
1 · Installation
An agent is associated with the server with a dedicated credential.
The Sentinel agent is installed on the machine to be protected and associated with the record created in the console. It collects identity and status of the machine, then opens the channel to the Sentinel core.
- A server credential, revocable and not shared between installations.
- TLS and authentication for the control channel.
- Local configuration preserved during managed updates.
- Administrative allowlist to reduce the risk of blocking legitimate access.
2 · Web protection
The WAF works on the server that hosts the site.
When the web module is configured in the domain's traffic path, Sentinel analyses method, URL, header and body of the request. User traffic does not pass through an external cloud service of G Tech Group.
- Observe: records what it would have blocked, useful for the initial tuning.
- Block: interrupt requests that exceed the defined thresholds.
- By domain: policy and sensitivity may differ between sites on the same server.
- Fail safe: Optional dependencies must not cause indiscriminate blockages.
3 · Host Protection
Server events can become blocks on the local firewall.
Watchers observe configured sources, such as SSH authentication and web server logs. When a sequence exceeds the threshold, the agent records the event and applies the block with the backend available on the machine.
- Threshold and time window configurable.
- Temporary or permanent blocks with priority given to allowlists.
- Synchronisation with external sources, including Fail2Ban when enabled.
- A separate Sentinel chain to keep the responsibility of the rules traceable.
4 · Synchronization
The core coordinates the fleet, but the server continues to defend itself locally.
Heartbeat, events and inventory reach the console; policies, allowlists and blocks return to agents. If the central link is temporarily interrupted, the rules already applied locally do not disappear.
- Heartbeat and version status for each machine.
- Distribution of rules and lists without repetitive server interventions.
- Reconnection and realignment after a channel interruption.
- Gradual rollout when the agent update mode allows it.
From event to response
What the team sees when Sentinel intervenes.
Contextualised event
Type of attack, origin, server involved, date and reason remain available on the timeline.
Action applied
The panel distinguishes detection and blocking, showing duration and origin of the policy when available.
Configurable alerts
Configured notifications alert the team without forcing them to observe the dashboard continuously.
Server Analysis
Status, logs and reports can be viewed across the fleet or filtered to the affected machine.
Clear borders
What Sentinel does and what still requires proper management.
A security platform reduces risk; it does not replace patches, backups, configuration and professional incident response.
✓
Keeps protecting
The local rules already distributed remain operational even during a temporary loss of connection with the console.
✓
Makes decisions verifiable
Events and logs help to understand what has been detected and what action has been applied.
!
Requires tuning
The transition from observation to block must consider real traffic, application and false positives.
!
Does not replace infrastructure
System updates, backups, hardening and application vulnerability management remain necessary.
Want to see the flow on your infrastructure?
Let's start with your servers, domains, and real traffic to define a verifiable activation.