Sentinel architecture

The security model of the Sentinel agent. Outbound-only on port 443, mutual TLS, signed releases and least privilege on the host.

WASViking^® Sentinel is an agent you install on a host inside your network so WASViking can scan internal targets. It opens an encrypted connection out to WASViking, and nothing on the internet ever connects in.

Network

• Outbound only. The agent connects to sentinel.wasviking.com on TCP port 443.
• No inbound ports. No firewall openings, no static IP allow-listing and no VPN are needed.
• No TLS interception. The connection must reach WASViking directly. A proxy that inspects TLS breaks the mutual authentication.
• Health reports. From version 1.24.0, the agent also sends a health report once a minute over the same outbound connection, with numbers about the host and the tunnel plus the operating system name and kernel version. The report carries no request or response content, no target data and no process list, and is kept for seven days (see Host and tunnel health).

Identity and encryption

• Mutual TLS. The agent and WASViking authenticate each other with certificates. The agent's certificate is issued when you register it and is bound to your organization.
• Certificate rotation. Certificates rotate on a schedule, and you can rotate or revoke them at any time from the portal.
• Organization boundary. An agent only receives work from its own organization and cannot reach the data of any other.
• Sensitive content stays out of logs. Cookies, CSRF tokens and the content of internal targets are not written to logs.

Signed releases

Every release is signed. Before installing, verify the download with the SHA-256 checksum and signature shown in the portal. See Installing the Sentinel agent.

Updates from the portal follow the same rule. The agent installs only packages signed by WASViking: it verifies the signature and the checksum, and a separate installer with administrator rights on the host verifies them again before installing. Downgrades are refused, the agent keeps running under its own unprivileged service account, and the host administrator can turn remote updates off. See Update from the portal.

Least privilege on the host

The agent runs as a dedicated system service with only the privileges it needs. The service is hardened against privilege escalation and cannot modify the operating system.

Supported platforms

What the agent does

• Internal scanning. The same DAST checks used on external targets run against your internal targets. See Internal scanning.
• SBOM, secrets and CI gates from the command line. See the other pages in this section.

Troubleshooting

The Sentinel Agents page in the portal shows each agent's state and last contact. For step-by-step fixes, see the troubleshooting section of Installing the Sentinel agent.