Usage

Usage

Dashboard

1. Sign in with UI_PASSWORD (the UI calls POST /api/login).
2. Overview lists agents; open one for detail views.
3. Per-agent views can include window focus, keystroke sessions, URLs, activity timelines, screen (MJPEG / still), software inventory, files, scripts (if enabled on the server), and agent settings (e.g. retention).
4. Global settings may cover retention, storage, audit review, and related options.
5. Audit lists operator actions where implemented.

Remote script execution is off unless ALLOW_REMOTE_SCRIPT_EXECUTION=true on the server. Enabling it is effectively arbitrary code execution on monitored machines.

Windows agent

What to configure

• WebSocket URL including path /ws/agent, for example:
  • ws://192.168.1.10:9000/ws/agent
  • wss://monitor.example.com/ws/agent
• Display name (defaults to Windows COMPUTERNAME).
• Shared secret matching server AGENT_SECRET. On the agent this is the agent password / environment variable AGENT_PASSWORD (the client does not use the name AGENT_SECRET).

The agent sends ?name=<name>&secret=<secret> on the WebSocket URL when a secret is set.

Tray UI (default)

Configure server URL, name, and secret in the UI. Settings are stored under %LOCALAPPDATA%\sentinel\config.dat (DPAPI-encrypted).

Headless / automation

Non-empty environment variables override saved config:

Variable	Purpose
AGENT_SERVER_URL	Base WebSocket URL including /ws/agent (query string added by the agent).
AGENT_NAME	Agent display name.
AGENT_PASSWORD	Must match server AGENT_SECRET.

Also useful:

• --no-ui or AGENT_NO_UI
• --show-ui or AGENT_SHOW_UI
• AGENT_LOG_FILE
• RUST_LOG

Build

From the agent/ directory:

cd agent
cargo xwin build --release

Output path depends on the target (e.g. target/x86_64-pc-windows-msvc/release/sentinel-agent.exe).

HTTPS, cookies, and reverse proxies

• TLS termination at a proxy: The proxy should send X-Forwarded-Proto: https. Then ENFORCE_HTTPS=true is appropriate, and session cookies can use secure settings when login is seen as HTTPS.
• Plain HTTP only: Set ENFORCE_HTTPS=false. Do not force COOKIE_SECURE=true unless the browser really uses HTTPS to the origin.

Use wss:// for agents when the public server URL is HTTPS; use ws:// only for cleartext testing on trusted networks.