Install SentrAI
SentrAI watches your logs, scores the risk of what it sees, and blocks attackers inside your own network. It never strikes back. This guide gets it running, from a laptop to a server that keeps watch around the clock.
Pick your path
| You want to | Go to | Time |
|---|---|---|
| Run SentrAI on your own computer | Run on a laptop | about 5 minutes |
| Keep SentrAI running on a Linux server | Install on a server | about 10 minutes |
| Watch several machines from one dashboard | One panel, many machines | about 10 minutes per machine |
| See which logs SentrAI reads (Windows, Suricata, databases) | Log sources | |
| Sign in, invite your team, or reset a sign-in | Signing in | |
| Change thresholds, alerts or protected IPs, or tell SentrAI who your administrators are | Settings | |
| Fix a port clash, a missing package or a blocked dashboard | Troubleshooting | |
| Call SentrAI from your own scripts and tools | API reference |
What you need
| Laptop (Windows) | Laptop (Linux or macOS) | Server | |
|---|---|---|---|
| System | Windows 10 or 11 | any recent Linux, or macOS | Linux with systemd |
| Python | 3.12, on your PATH | 3.11 or newer, with venv |
3.10 or newer, with venv |
| Rights | your normal account | your normal account | sudo |
| Also | Git, or the ZIP from GitHub | Git | Git, and nft or iptables to open the dashboard to other computers |
A machine you add to a central panel needs Linux with systemd or Windows 10, 11 or Server 2016 and newer, with Python 3.10 or newer and administrator rights.
On Debian and Ubuntu, add the venv module with:
sudo apt install python3-venv git
No Docker is needed. Each part of SentrAI makes its own Python environment the first time it runs, so the first start takes a minute or two longer than the next ones.
Get the code
git clone https://github.com/RexGuard/SentrAI
cd SentrAI/mvp
No Git? On the GitHub page choose Code, then
Download ZIP, unzip it and open the mvp folder inside.
Every command in this guide is run from that mvp folder unless it says otherwise.
What runs where
| Part | What it does | Address on your machine |
|---|---|---|
| Core | scores risk, decides on blocks, keeps the tamper-evident record | 127.0.0.1:8000 |
| Collector | reads the log files you approve and passes new lines to the core | |
| Web dashboard | the console where you review, approve and change settings | 127.0.0.1:5173 (started with run-web) |
| Classic dashboard | the earlier Streamlit console, kept as a fallback and for demos | 127.0.0.1:8501 |
| Notifier | sends alerts to Telegram or email, with Approve and Reject buttons | |
| Agent | only on extra machines that report to a central panel: sends their logs and applies their blocks | outgoing HTTPS only |
The core only ever listens on your own machine. The dashboards do too, unless you open it to named IP addresses during a server install.