Component Guide & FAQ

How the pieces fit together

Sentry is organised around a simple intelligence workflow. Most components fall into one of these stages, and a typical investigation flows left-to-right:

• Collect — pull data in on demand or in bulk: FieldQuery, Collectors, CrowdSight, Bulk Import, Image search, Crawlers.
• Monitor — keep watching once, get told when something changes: OverWatch, Watchlists, Events, Saved searches.
• Analyse & understand — turn raw items into intelligence: Nexus profiles, Threat actors, Narratives.
• Investigate & collaborate — work a case with your team: Dossiers, Teams, Saved.
• Distribute — push findings out: Reports, Webhooks.
• Diagnose — see why the system behaved as it did: the Relevance Gate.

Contents

Search

FieldQuery — search across intelligence sources

What it is: An on-demand search that fans a single query out across dozens of OSINT providers — web, news, social, blogs, RSS, dark web, threat intel, public records and more — then deduplicates, scores, and stores the results for you.

How to use it: Type a query (the operator toolbar supports "exact phrase", AND, OR, -exclude, site:, filetype:), or use a Quick Template (Person, Company, Email, Social, Docs, News) and fill in what you know — the more fields you complete, the more companion searches run in parallel. Choose Exact match mode for names, or Broad to catch any word. Pick your data sources: "always on" channels fire every time, while specialised channels (dark web, threat intel, sensors, public records) switch on automatically when your query contains an indicator like an email, IP, domain, hash, CVE, or coordinate — or when you tick them manually.

Good to know: Results open in a dedicated results view; heavy work (AI enrichment, threat scoring, profile generation, alerting) finishes in the background a moment after the page loads. If a search returns nothing, the diagnostics panel shows exactly which providers were queried, skipped, or came back empty. Result-count ceilings above 1,000, and automatic profile generation, are paid-plan features, and each search counts toward your monthly quota (which is shared with feeds).

Monitoring

OverWatch — real-time data feed monitoring

What it is: Standing monitors that keep collecting on a schedule, score every item, and raise alerts — the "always watching" counterpart to a one-off FieldQuery search.

How to use it: Create a feed and pick a type (keyword, topic, entity, person, company, or location) and a refresh interval (from real-time to daily). Person, company, and location feeds ask for identity anchors — geographic, occupational, digital, jurisdictional and so on — so the feed tracks the right subject rather than everyone who shares a name. Location feeds can draw a geofence on a map and define which event types matter. Finish by choosing an alert severity threshold and delivery channels (email, SMS, in-app).

Good to know: A person feed needs at least three independent anchors (and a company feed needs a name plus a jurisdiction or domain) before it will activate — a name on its own is rejected by design, because it produces noise. Collection and alerting are separate: a feed can ingest many items but alert on only a few, depending on your freshness window and severity threshold. Feeds are a paid feature and count toward your monthly usage.

Watchlists — track named entities for hits

What it is: A standing list of names and identifiers you want flagged whenever they appear in anything Sentry ingests.

How to use it: Create a watchlist, set the minimum severity that should alert you, and add entries. Entries can be simple typed identifiers (person, organisation, domain, email, IP, hash, handle) or richer subjects built in the Query Builder, where you add aliases, related people and companies, infrastructure indicators, and excluded terms. The builder previews the match terms and shows a confidence and false-positive estimate before you save.

Good to know: A watchlist does not run a search — it only matches against new items as they arrive from your searches and feeds, so nothing alerts until fresh data is ingested. Hits below your minimum severity are suppressed, and repeat hits on the same item are deduplicated. Owners can share a watchlist with teammates or keep it private.

Events — time-bounded subjects

What it is: A first-class record for something that happens within a window — a protest, executive travel, a conference, a security incident — that alerts can be pinned to and reported on afterwards.

How to use it: Create an event with a type, severity, and optional start/end window, and (optionally) attach a geofence zone, a runbook link, and escalation notes. In edit mode you can link the Nexus profiles, organisations, watchlists, and zones the event concerns, so matching alerts attach automatically. When it's over, generate a SITREP, executive brief, or post-event report built from the alerts that fired during the window.

Good to know: An event doesn't generate alerts itself — it tags and organises alerts your monitors produce. Only events in the active or monitoring status auto-associate alerts, and the geofence dropdown is empty until you've created a zone in OverWatch.

Saved searches — recurring queries with diff alerts

What it is: A query that re-runs on a schedule and tells you when new results appear that weren't there last time.

How to use it: Give it a name and query, choose a schedule (hourly, every six hours, daily, weekly, or manual-only), and tick "alert on new results since last run." You can also save one straight from a results page. Use Run now to trigger an immediate run, or pause and resume any time.

Good to know: "Run now" is asynchronous — give it a minute, then refresh. A saved search is lighter than an OverWatch feed: it re-runs a query and diffs the results, whereas a feed continuously ingests and scores everything it collects. Pick a saved search for periodic re-checks and a feed for live monitoring.

Profiles

Nexus — entity intelligence profiles

What it is: A searchable library of dossiers on the people and organisations that appear in your investigations, with risk scoring, a relationship graph, and a timeline of activity.

How to use it: Profiles are generated automatically from searches (with profile generation enabled), so you don't build them from scratch — you browse, filter (by type, confidence, risk level, or flagged status), and enrich them. Open a profile to edit its details across tabs (basics, business, financial, leadership, OSINT links), link it to other entities with typed relationships, add flags, or run "full profile enrichment" to fan out across social, threat-intel, credential-leak, dark-web, and news sources. The Network view renders the whole entity graph.

Good to know: There's no "add profile" button — the way to create one is to run a search with profile generation on. Nexus is a paid feature; if you've just upgraded, access can take a minute or two to appear because plan status is briefly cached.

Threat actors — registry + IoC pivot graph

What it is: A curated registry of known threat actors (for example APT-29, FIN7, Lazarus) and their indicators of compromise. When an analysed item contains an IoC that matches an actor, the item is automatically attributed to them.

How to use it: Browse the registry to see each actor's aliases, motivation, sophistication, IoC count, and recent observations. Open an actor to see its IoCs and every item that mentioned it. Use the pivot action on any indicator to see which actors use it, their other known indicators, and where it's been observed across your feed items and search results.

Good to know: The registry is operator-curated and global — registering actors and adding IoCs is an admin task, so a fresh registry starts empty until it's seeded. Attribution is purely indicator matching (domains, IPs, hashes, emails, handles), not an analyst's judgement.

Narratives — the same story across N outlets

What it is: A read-only viewer that folds many articles telling the same story into a single narrative, so a campaign or event shows up once instead of as dozens of near-duplicates.

How to use it: Choose a time window (24 hours to 30 days) and browse the active narratives, sorted by severity and size. Open one to see its title, dominant threat level and type, the entities involved, and every member item (each marked as the canonical story or a supporting one) with a similarity score.

Good to know: Clustering is automatic as items are analysed — there's no manual merge, split, or rename. Only clusters worth attention appear (at least two members, or a medium-or-higher threat), so single-source or low-signal items are filtered out. Grouping is based on shared entities and title keywords by default.

Cases

Dossiers — investigation case files

What it is: A case-file workspace that bundles the searches, profiles, custom items, notes, tasks, and uploaded files for one investigation into a single place.

How to use it: Create a dossier with a name and colour label, then add items — a saved search, a Nexus profile, or a custom entry (title, URL, notes). Keep a running notes feed (notes can be marked private), track a task checklist with priorities and due dates, and attach files. Each item expands inline to preview its contents.

Good to know: Dossiers are collaborative, with owner, editor, and viewer roles. Owners and editors can add items, notes, and files; viewers are read-only; only the owner can change the dossier's settings. Sharing is governed by the dossier's own member list — picking a team when you create one just tags it, it doesn't grant the whole team access.

Teams — team workspace

What it is: Where you create a team, invite people, and control what each member can see and do.

How to use it: Create a team, then invite members by email and assign a role (owner, admin, member, viewer). The Permissions tab lets you override individual permissions per member, and the Content Policies tab lets an owner block specific data sources or features for the team — including an external-AI kill switch that stops any team content from being sent to external AI providers while keeping local analysis running.

Good to know: Invitations stay pending until the recipient accepts them, matched to their account email — so someone won't appear as a member until they accept. Admins can view the Permissions tab but only the owner can save permission and content-policy changes. Your plan sets the team-member limit shown at the top of the page.

Collection

Collectors — AI-powered local data collection

What it is: Small collector agents you install on your own machines that securely push local files and documents into Sentry for analysis, so on-premises data can be enriched alongside open-source intelligence.

How to use it: The deploy wizard walks you through it: generate a registration token, install the Python agent, register it against the server, then point it at folders to watch (by file type and pattern) and either sync once or run it as a daemon on an interval. Back in the UI you approve, revoke, or delete agents and review each one's transfer history.

Good to know: Two steps are easy to miss — a newly registered agent must be approved in the UI before it can push anything, and you must add at least one watched folder. Registration tokens are single-use and expire in about an hour, and token generation is rate-limited, so generate the token right before you register. Agents are outbound-only — there's no channel to remote-control your machine — and transfers are encrypted in transit.

CrowdSight — community-driven intelligence

What it is: A place to collect and triage human-submitted tips and reports from many channels, then fold the validated ones into your monitoring.

How to use it: Add submissions manually (title, content, category, priority, location), or generate a public share link so external contributors can submit without an account — with an optional welcome message, submission cap, and expiry. You can provision a dedicated SMS number to receive tips by text, define alert rules (keyword, geofence, entity watch, or volume spike), and adjust the trust score of each source as you learn how reliable it is. Validate or reject submissions, and run "Process Pending" to correlate them.

Good to know: A public share link is for outside contributors with no account, while a new submission is for logging intel yourself — both create submissions but serve different audiences. SMS features depend on a configured Twilio integration; provisioning a number won't work without it.

Bulk Import — upload CSV, JSON, XML files

What it is: A one-off drag-and-drop uploader for bringing structured records into Sentry in bulk.

How to use it: Drop a CSV, JSON, or XML file and you'll get a preview of the headers and sample rows. Choose what to import the rows as — entity profiles, threat indicators (IOCs), watchlist entries, or feed items — adjust the field mapping if the auto-guess got a column wrong, then import. A result banner reports how many rows were imported and how many were skipped, and an import history lists your recent jobs.

Good to know: Files are capped at 50 MB and only CSV, JSON, and XML are accepted. Importing as "feed items" needs a target feed ID or the rows have nowhere to go. Rows that fail validation are silently skipped rather than failing the whole job, so if the imported count is lower than expected, check your field mapping.

Image search — OCR text + reverse-image lookup

What it is: An analyst tool for searching across every image the pipeline has already processed, and for analysing a new image on the fly.

How to use it: There are three modes. Upload an image (drop, browse, paste, or give a URL) to extract its text, EXIF/GPS, and perceptual hashes and find visually similar stored images. Search OCR text to find words that appear inside images (a stamp like "CONFIDENTIAL", a brand, a document number). Or search by hash to find near-duplicates of a known image. Any result opens a drawer with the source link, EXIF table, GPS map link, full OCR text, and a "find visually similar" pivot.

Good to know: The similarity threshold matters — around 4 or below means essentially the same image, 5–8 means visibly similar, and 9+ starts producing false positives. Uploaded images are analysed but not stored (max 15 MB); the searchable library is populated automatically by the ingestion pipeline, so to add an image you ingest its source, not upload it here.

Archive

Saved — bookmarked results

What it is: A personal bookmark manager for the search results you've saved or flagged.

How to use it: Save or flag a result from anywhere in the app, then manage it here. Group saved items into colour-coded collections, add notes and tags, and filter by collection or free-text search. The Flagged tab keeps items you've marked with a reason. Tabs let you view everything, just saved, or just flagged.

Good to know: Items aren't created here — you bookmark them elsewhere and organise them here. Collections and tags apply to saved items; flagged items carry a flag reason and notes instead. Everything on this page is private to you.

Reports — scheduled intelligence reports

What it is: Recurring briefings that Sentry generates and emails to you automatically.

How to use it: Create a report with a name, a type (search summary, feed summary, threat summary, or entity report), a source (all sources, a specific search, or a feed), a schedule (daily, weekly, bi-weekly, or monthly), and a format (PDF, CSV, or JSON). The list shows each report's schedule, last-generated and next-run times, and lets you pause or delete it.

Good to know: Reports are delivered by email — this page is for configuration and status, not for downloading files. Generation is batched by a once-daily job, so "next run" reflects the scheduled window rather than an exact minute, and paused reports don't run. You can only report over sources you own.

Integrations

Webhooks — Slack / Teams / Discord / SIEM / MISP / TAXII

What it is: Outbound connectors that push Sentry alerts into the tools your team already uses — chatops, a SIEM/SOAR, or a threat-sharing platform.

How to use it: Add a webhook, choose a destination format (Generic JSON, Splunk HEC, Elasticsearch, CEF, LEEF, Slack, Microsoft Teams, Discord, MISP, or STIX/TAXII), paste the HTTPS URL, and pick an auth type — the form suggests a sensible default for each format. Set a minimum severity so only alerts at or above that level fire, and optionally restrict to specific event types. Use the per-row Test button to send a live payload and confirm it lands.

Good to know: For Slack, Teams, and Discord the URL itself is the secret, so leave auth set to none; MISP uses a custom header for its API key. Endpoints must be HTTPS, and private or internal addresses are blocked for security. If nothing arrives, check that the alert met your minimum severity and event-type filter — the last delivery status is shown in the list.

Diagnostics

Relevance Gate — why your results were kept or filtered

What it is: A read-only report explaining how Sentry's relevance filter treated your own search results — how many were kept, down-ranked, or filtered out as off-topic, and why.

How to use it: Choose a time window (1 hour to 30 days), optionally narrow to a single search by its query ID, and optionally filter by tier. You get two tables: results grouped by tier (strong and good were kept, borderline was kept but down-ranked, rejected was filtered out) and grouped by the reason that drove each decision.

Good to know: This is the place to look when you expected a result and didn't get it — or got noise you didn't expect. Decisions are only recorded as results are stored, and only for your own searches, so a quiet window or a brand-new account may show nothing yet.

Tools

Crawlers — web crawlers & scrapers

What it is: A dashboard for browsing the results of Sentry's web crawlers — the pages they've fetched and the data extracted from them.

How to use it: When the feature is enabled for your deployment, the page shows crawler stats (active crawlers, total items, items in the last 24 hours, cached pages) and a table of the most recent results with their title, source, and extraction time.

Good to know: Crawlers are an optional feature — if you don't see the menu item, it isn't enabled for your account. This page is view-only; creating and configuring crawlers is an administrator function. Crawler data is shared across your team.

Frequently asked questions

What's the difference between a FieldQuery search, a Saved search, and an OverWatch feed?

A FieldQuery search runs once, right now. A Saved search re-runs that same query on a schedule and alerts you when new results appear. An OverWatch feed continuously ingests and scores everything matching a topic or entity, with richer alerting. Reach for a search to answer a question today, a saved search for periodic re-checks, and a feed for live monitoring.

I created a person or company feed but it won't activate. Why?

Person and company feeds require identity anchors so they track the right subject. A person feed needs at least three independent anchors; a company feed needs a name plus a jurisdiction or domain. A name on its own is rejected on purpose — it would match everyone who shares that name and flood you with noise. Add more anchors and the feed's strength score will let it activate.

I added a watchlist entry but nothing is alerting.

Watchlists don't run searches — they match against new items as your searches and feeds ingest them. Until fresh data arrives that mentions the entry, there's nothing to match. Also check the watchlist's minimum severity: hits below it are suppressed.

Why can't I create a Nexus profile manually?

Nexus profiles are generated automatically from searches. Run a FieldQuery search with profile generation enabled and a profile is built from what it finds. On this page you browse, filter, edit, and enrich existing profiles rather than adding new ones from scratch.

I "Ran now" but I don't see results.

Runs are asynchronous. Whether it's a saved search, a background enrichment, or a report, the work finishes a moment after you trigger it. Give it a minute and refresh.

How are threat levels decided?

Every item is scored and mapped onto a five-level ladder: informational (0–19), low (20–39), medium (40–59), high (60–79), and critical (80+). News, academic, and satirical content is automatically downgraded when there's no credible intent, which keeps routine reporting out of your high-priority alerts.

Why did I get an alert that doesn't look like a real threat — or miss one I expected?

Start with the Relevance Gate to see whether the item was kept, down-ranked, or filtered, and why. For missed alerts, confirm the source that would have caught it was enabled, that the item met your alert's minimum severity, and that it fell inside the alert's freshness window.

Why isn't a data source returning results?

Some channels only switch on when your query contains a matching indicator (an email, IP, domain, hash, CVE, or coordinate), and some are gated by your plan. On a search that returned nothing, the diagnostics panel lists exactly which providers were queried, skipped, or came back empty.

My teammate can't see my dossier / watchlist / feed.

Sharing is explicit. A dossier is shared through its own member list with owner, editor, and viewer roles — associating a team when you create it only tags it. Watchlists have a shared/private toggle. Confirm the item is shared and that your teammate is on the same account or team.

My Collector registered but isn't sending anything.

Two steps are easy to miss: a newly registered agent must be approved in the Collectors UI before it can push, and it needs at least one watched folder. Also note that registration tokens are single-use and expire in about an hour, so generate the token immediately before registering.

My webhook (Slack / SIEM / MISP) isn't firing.

A webhook only fires for alerts at or above its minimum severity and, if you set one, within its event-type filter. The URL must be HTTPS, and private or internal addresses are blocked. Use the Test button to send a live payload — the last delivery status appears in the list.

Where do I download a scheduled report?

Scheduled reports are delivered by email on their schedule. The Reports page is for configuring them and checking their last and next run times — there's no in-app download of a generated report there.

What counts against my monthly usage?

Both FieldQuery searches and the feeds you create draw from the same monthly counter. If you're near your limit, the search form is disabled until your billing period resets or you upgrade. Some capabilities — larger result sets, automatic profile generation, and Nexus access — are paid-plan features.

Can I stop my data going to external AI providers?

Yes. A team owner can turn off "allow external AI processing" in Content Policies. With it off, no team content is sent to external AI providers, while local analysis continues to run.

More help

• Documentation home — getting started and core concepts.
• API Reference — integrate Sentry with your own systems.
• Changelog — what's new and recently improved.
• System Status — current platform health.