Continuous monitoring with Sentinel
A read-only watcher on your server plus AI triage on anomalies: what it checks, what it costs, what it cannot do.
Last updated · September 2026
On this page
Sentinel is Bolt's background defensive mode: a small watcher that lives on your server, runs deterministic read-only checks every few minutes, and calls the AI only when something looks wrong. You get an email and an in-account alert with evidence and a triage — not a stream of raw logs.
What it watches
| Signal | What it means |
|---|---|
| Auth bursts | Many failed logins in a short window — the classic guessed-password shape. |
| New listeners | A TCP port listening that was not at baseline — unexpected exposure or persistence. |
| Watched files | SHA-256 changes to identity, sudo, SSH, and cron configuration. |
| Resources | Load, memory, and disk pressure against multiples of your baseline. |
Start watching in four steps
- Install and sign in on the server
npm install -g bolt-sec, then bolt login. The daemon phones home with your token, so it only ever reports to your account.
- Take a safe first pass
Run bolt watch check --no-triage --no-report. Fully local: it establishes baselines and shows what would alert, without sending or spending anything.
- Start the daemon
bolt watch start runs a check every 5 minutes (tune with --interval). bolt watch stop ends it; the server side can also disable a host.
- Read the first alert
High and critical findings arrive by email and in Dashboard → Watch alerts, with evidence and an AI triage. Acknowledge or resolve them there.
What it costs
Deterministic checks are unlimited and unmetered — they run on your machine, not ours. Only AI triage is metered: 3 free triages a day, then Sentinel covers 300 triages per 30 days for 30,000 UGX (activate on the Billing page). Unused triages do not roll over. When quota runs out the incident is still recorded and emailed — only the AI write-up waits.