Attack response

Attack response makes the node act on its own after Sentinel confirms an attack. It is off until you turn it on.

How it works

When Sentinel confirms an attack, attack response can start one or more follow-up actions automatically: triangulate the attacker, capture packets, or run a scan. You choose which actions run and how long each one lasts. This turns a detection into a record of what happened without you being there.

What it can do

Action	What it does
Triangulate	Starts a triangulation hunt on the attacker's address
Packet capture	Captures Wi-Fi traffic to SD
Device scan	Runs a device discovery scan
Probe scan	Runs a probe request scan
Drone scan	Runs a drone detection scan

Each action has its own length, which you set. Turn the actions on under the Sentinel tab → Attack response.

If it does not fire

Attack response runs only after Sentinel confirms an attack, so Sentinel must be on and the detector for that attack must be enabled. An action that is turned off does not run. Check the incident log to confirm the attack was confirmed, not just seen.