Sentinel and monitoring
Besides the console and the vault, SHTERA watches what happens on your servers along two different paths: what gets typed inside a session, and what changes outside of one.
Inside an open session
While an SSH or RDP console of SHTERA is open, twelve rules check what is typed on the spot: a password change, a new user, an SSH key added to the authorized ones, wiping the command history or the system logs, a download executed right away, a connection back out, a scheduled task, the firewall turned off, or a recursive delete from root.
The alert arrives while the session is still open, not at the end. The audit log records which rule fired, never the text that triggered it — it could be the password the person just typed.
Outside a session: the sentinel
A sentinel polls each Linux or Windows server every few minutes, over SSH or WinRM, looking for the same things as the twelve rules above —changed passwords, new users, scheduled tasks, a disabled antivirus— without anyone having opened a SHTERA session. This covers the case of a script left in a scheduled task, downloaded from somewhere.
It never tries a password against the server: that locks the account after a few failed attempts and, on Windows, can disconnect someone who is working. The sentinel only reads metadata — file dates and hashes — it never attempts to sign in.
Server state, live
The same check measures, every few minutes, each server’s processor, memory, disk —the fullest filesystem, not just root—, swap, and uptime. It shows up live in the dashboard, with nothing to install on the client’s server.
How the alert arrives
When one of the rules that really matters fires, the alert arrives by email and by WhatsApp. The sentinel is included on every plan, at no extra cost.
AI image analysis
Optional, on-request add-on with price on request: it automatically reviews recorded sessions looking for risky moves in the images. It is contracted separately, server by server.
