AXISSentinel
Sentinel Command

Sentinel FIRST LIGHT

From signal to command surface.

Every signal accounted for.

FIRST LIGHT is Sentinel's operating architecture. It describes how telemetry leaves an AXIS service, how it is proven genuine, where it is kept, and how it becomes something an operator can act on.

Sentinel FIRST LIGHT data flowAXIS services and the Cloudflare edge emit signed SCEF telemetry. Sentinel ingestion verifies each signature, writes a searchable event index to PostgreSQL and preserves raw evidence in R2. Ledger, Trace and Pulse are maintained from that record, and Sentinel Command presents the resulting live state.AXIS Services7D · Core · ARK · Telesis · EliteCloudflare EdgeWorkers · Pages · WAF · AccessSigned SCEF Telemetrysignature required before trustIngestion + VerificationSentinel control planeEvent IndexPostgreSQL · searchableRaw EvidenceR2 · preserved intactLedger · Trace · Pulsehistory · reconstruction · stateSentinel Commandlive operational surface
Sentinel FIRST LIGHT — observation to command surface

Flow

Verification happens before trust, not after.

The ordering in this diagram is the point. Signature verification sits ahead of indexing, and preservation sits ahead of any remediation. A pipeline that indexes first and verifies later has already acted on data it could not vouch for.

09:41:02.118axis-7d · policy.evaluate · tenant=acme · allowSIG OK
09:41:02.940cloudflare-edge · waf.challenge · ray=8f2c…a19SIG OK
09:41:03.406axis-core · session.privileged.open · actor=svc-deploySIG OK
09:41:04.771axis-ark · replication.lag · 240msSIG OK
09:41:05.233watchtower · source.silent · axis-telesis · 00:04:12UNVERIFIED
09:41:06.019evidence · ledger.append · seq=48 812 · sha256=c1f0…7b2SIG OK

Layers

What each stage is responsible for.

  • AXIS services and Cloudflare

    Sentinel observes AXIS 7D, Core, ARK, Telesis and Elite alongside the Cloudflare edge that fronts them — Workers, Pages, WAF and Access. Both application and edge behaviour are in scope, because an attack rarely respects the line between them.

  • Signed SCEF telemetry

    Signals are emitted in a signed common event format. The signature is part of the contract: Sentinel verifies it before the event is trusted, and an unverified signal is retained and reported rather than discarded or believed.

  • Ingestion and verification

    The control plane verifies signatures, normalises events, applies detection and reconciles what arrived against what Watchtower expected. Absence is evaluated here, which is why a silent source becomes a finding.

  • Event index — PostgreSQL

    Searchable event records live in PostgreSQL. This is the index an investigator queries: fast, structured, and rebuildable from preserved evidence if it is ever lost.

  • Raw evidence — R2

    Original payloads are preserved unmodified in R2, separate from the index and with their own retention. Separating the two means remediation on one cannot quietly destroy the other.

  • Ledger, Trace and Pulse

    Durable history, decision reconstruction and current state are derived from that record and maintained continuously, rather than assembled on demand during an incident.

  • Sentinel Command

    The operational surface. Command reads Pulse for live state and Ledger and Trace for history, and is where an operator acts — every action recorded in the same write as its effect.