Skip to content
sentrasec

Core concepts

Workspaces, apps, targets, scans, findings and the knowledge graph, as the rest of the documentation uses them.

A short vocabulary. These terms mean something specific in Sentrasec, and the rest of the documentation uses them precisely.

Workspace

The top-level tenant boundary. A workspace owns apps, users, policies and findings. Access control, retention and billing are all scoped to it.

App

A logical unit of software you are securing: typically a service, a repository or a deployable component. An app groups everything scanned about that unit so its findings, history and posture stay together over time.

Target

A specific thing a scan runs against: a repository path, a container image, a running URL, a cloud account or a cluster. One app usually has several targets: the source, the image built from it, and the deployed instance.

Scan

One execution of one or more scanners against a target. A scan is immutable: it records what ran, against what, when, and with which rule versions. Reproducibility depends on that.

Finding

A single detected issue, anchored to a location in a target. Findings carry:

  • What matched: the rule, and the code path or configuration that triggered it.
  • Classification: CWE, OWASP category, and CVE where applicable.
  • Severity: on one scale across every scanner.
  • Evidence: the artefacts supporting the detection.
  • Context, which app, environment and owner it belongs to.

Findings are deduplicated across scanners within a scan, and correlated across scans over time, so the same underlying issue stays one finding as it moves through its lifecycle.

Rule

A detection definition. Rules are versioned, and reach your deployment either from Sentrasec over an encrypted connection or from a signed offline snapshot. A rule declares its relationships, the weakness class it detects, the categories above it, which is what lets a finding explain itself.

Knowledge graph

The connected store of security knowledge: rules, CVEs, CWEs, OWASP categories, packages, fixes and the relationships between them, plus your environment context. Reasoning follows those relationships rather than performing a series of isolated lookups.

Policy

The rules governing what happens to findings: severity thresholds, gating behaviour in CI, exception handling and SLA windows. Policy is defined centrally and enforced wherever scans run.

Evidence

The artefacts that justify a finding or a decision about one. Evidence is what makes a downgrade auditable months later, and it is the raw material compliance reports are generated from.

Where things run

Scanning, findings and storage run in your environment. The Sentrasec engine supplies detection rules, vulnerability intelligence and reasoning over an encrypted connection.

That connection is optional: your deployment ships with bundled rules and offline vulnerability data, so it scans and reports with no connection at all. See self hosting.