Command Reference

The CLI is defined with clap (derive) in cli.rs and dispatched to the handlers in cmd.rs. Everything below was verified against those definitions.

Conventions: placeholders in backticks (<ip>, <path>); durations accept 24h, 7d, 30m. Almost every subcommand loads the config file (and many require Postgres in storage.postgres.url).

Global flags

Monitor / daemon

sentry run

Starts the daemon in the foreground: sources → pipeline (rules → heuristics → AI/LLM) → actions, hot-reload via LISTEN/NOTIFY, prune tasks and the Prometheus metrics server. Handler in daemon.rs.

sentry run

sentry serve

Web dashboard (build-step-free SPA) + JSON API in a separate process. Requires Postgres. Bind and auth come from [server]: host (default 127.0.0.1), port (default 8080), auth.mode = "none"|"password"|"token"|"both" with RBAC (admin mutates, viewer is read-only). Handler in server.rs.

Endpoints: / (dashboard), /api/health, /api/login, /api/logout, /api/me, /api/events, /api/stats, /api/incidents (+ /{id}/ack and /{id}/resolve), /api/ips/blocked (+ /{ip}/block, /{ip}/unblock, /{ip}/forgive).

sentry serve

Live tail

sentry tail

Live event tail straight from Postgres. Opens the interactive TUI when stdout is a TTY; outside a TTY (or with --stream) it prints one line per event. Implementation in tui/mod.rs and tui/stream.rs.

sentry tail --only High,Critical --theme mono
sentry tail --stream --json | jq 'select(.level == "critical")'

Incidents

sentry incidents

List and inspect unresolved incidents. Handler in cmd.rs. Ack/resolve happen through the HTTP API (POST /api/incidents/{id}/ack and /{id}/resolve) or the dashboard.

sentry incidents list
sentry incidents show 6ba7b810-9dad-11d1-80b4-00c04fd430c8

IP

sentry ip

Inspect or block/unblock an IP. The IP is positional and comes before the subcommand; with no subcommand it defaults to info. Blocks publish sentry_blocks_changed (daemon and edge enforce within seconds). Handler in cmd.rs.

sentry ip 203.0.113.7 info
sentry ip 203.0.113.7 block --ttl 24h --note "scanner"
sentry ip 203.0.113.7 forgive

Routes

sentry routes

Known routes (config ∪ database). Handler in cmd.rs; importers in routes_import.rs.

sentry routes learn --min-hits 20 --min-ips 3
sentry routes import openapi.yaml --dry-run

Auto-detection

sentry auto

Detects frameworks/routes and generates sentry.auto.toml (known routes + packs + suggested rules). Detection lives in the sentry-auto crate; orchestration and the HTTP probe in auto.rs.

• With a path (sentry auto /var/www/app): scans the project tree (bounded walk) and extracts routes for the nginx, WordPress, Laravel, Next.js and Express profiles.
• Without a path: runs everything on its own — reads server configs from disk (/etc/nginx, sites-enabled/conf.d) and probes the local service on ports 80/443 (robots.txt, sitemap.xml and ~60 common paths; a random sentinel path filters catch-all/SPA fallbacks).
• Opt-in modules: pass --probe and/or --disk to run just one; with no flags, both run.
• Output: a METHODS | PATH table + detected frameworks and the sentry.auto.toml written next to the resolved sentry.toml. When nothing is found the command prints nothing (exit 0) and writes no file.

The generated file is cascade-loaded automatically: on every config load, routes.known, rules.pack and rules.custom from sentry.auto.toml are appended with dedupe — whatever is in your sentry.toml always wins (there is no --merge; the cascade replaces that flag).

sentry auto                        # everything: disk + 80/443 probe
sentry auto /var/www/app --dry-run # just preview what would be detected
sentry auto --disk                 # zero traffic: reads configs from disk
sentry auto --profile wordpress    # force the profile and probe WP paths

Rules engine

sentry rules

CRUD for custom database rules + view of config packs. Changes publish sentry_rules_changed (hot-reload, no restart). Handler in cmd.rs.

sentry rules add --name "block admin scan" \
  --match 'path starts_with "/admin" AND country = "RU"' --action block
sentry rules test --path /.env --ua "sqlmap/1.0" --ip 203.0.113.7

Reputation feeds

sentry feeds

Reputation feeds configured in [[rules.feeds]] (Tor, Spamhaus, FireHOL, datasets…). Handler in cmd.rs.

sentry feeds check 203.0.113.7

Datasets

sentry datasets

DB-backed datasets (User-Agent, path or JA3 lists) that become dataset:<name> synthetic rules and feed the dynamic prefilter. Handlers in cmd.rs and datasets.rs.

sentry datasets import bad-bots.txt --kind user_agent --name bad-bots --action block --dry-run

Trusted IPs

sentry trusted

Built-in trusted IP presets for [real_ip] trusted_lists. Handler in cmd.rs.

sentry trusted list

Firewall

sentry firewall

Inspection of the kernel ban backends. Handler in cmd.rs. Linux-only (reports unavailability elsewhere).

sentry firewall status

Bot verification

sentry bots

rDNS crawler verification (F7.10) — PTR under the engine's domains + forward-resolve back to the IP. Uses the system resolver, no daemon needed. Handler in cmd.rs and botdns.rs.

sentry bots check 66.249.66.1 --ua "Googlebot/2.1"

Protocols

sentry protocol

Validation and inspection of the protocol DSL schemas (F9). Handlers in protocol_cmd.rs.

sentry protocol validate
sentry protocol check schemas/game.protocol.yaml --hex 0001ff

Auth helpers

sentry auth

Generates the hashes used by [server.auth]. Handlers in auth.rs.

sentry auth hash-password "s3cret!"

OS service

sentry service

Installs the daemon as a system service: systemd (/etc/systemd/system/sentry.service), launchd (~/Library/LaunchAgents/com.sentry.daemon.plist) or a real Windows Service (SCM). The service runs sentry run. Handler in service.rs.

sentry service install --user sentry --workdir /etc/sentry

Reports

sentry report

Postgres aggregate report: events by level and verdict, top IPs and top paths. Handler in cmd.rs.

sentry report --from 7d --export csv
sentry report --unknown-paths

sentry posture

Web security posture (F11): part 1 is a config checklist (TLS, HTTP→HTTPS redirect, posture enabled); part 2 aggregates the header advisories observed on the protected site's responses (inline edge, shadow) with a remediation hint per line. Handler in cmd.rs; checks in posture.rs.

sentry posture --from 24h

SIEM export

sentry export

Exports raw events as CEF, LEEF 2.0 or JSON for SIEM consumption. Serializers in siem.rs.

sentry export --from 7d --format leef --out sentry.leef
sentry export --follow --to udp://siem.internal:514

Config

sentry config

Validates or prints the resolved config. Handler in cmd.rs.

sentry config validate

AI model

sentry model

Lifecycle of the classic ONNX model. Handler in cmd.rs.

sentry model export --synthetic --rows 8000 --out seed.csv
python tools/train_model.py --csv seed.csv
sentry model reload

Cloudflare

sentry cloudflare

Cloudflare integration (credentials via SENTRY_CF_TOKEN, SENTRY_CF_ZONE and optionally SENTRY_CF_ACCOUNT). Handler in cmd.rs.

sentry cloudflare status

Isolated test

sentry test

Runs the pipeline (rules + heuristics + scorer) on a single payload, no network or database. Handler in cmd.rs.

sentry test "1' OR '1'='1" --path /login --method POST

Benchmarks

sentry bench

Provider evaluation harness. Handler in bench_llm.rs.

sentry bench llm --providers jev,openrouter,ollama --n 200

Environment variables

Secrets never go into committed config — use the environment. Beyond the table, every config key can be overridden through env with the SENTRY_ prefix and __ nesting (e.g. SENTRY_STORAGE__POSTGRES__URL); the overlay is implemented in config.rs.