Skip to content

Glossary

An alphabetical reference for the product vocabulary used throughout the app and this documentation site. If a term links to a page, that page has the full detail.

The Sencai fleet agent - software installed on a server (cloud or on-premise) that reports inventory, patch, and security status back to Sencai, and enables runbooks and remote execution on that server. See Fleet agent.

A pending action that requires sign-off from an authorized user before it proceeds, rather than executing immediately - used for privileged requests like just-in-time elevation. See Approvals.

A single entry in Sencai’s append-only audit trail: who did what, when, and to what. Every mutating action across the platform is recorded this way. See Audit log.

A reusable infrastructure template you define once and deploy repeatedly, instead of provisioning the same set of resources by hand each time. See Blueprints & catalog.

A resource created by deploying a blueprint, tracked as its own record separate from resources provisioned directly. See Blueprints & catalog.

A tracked, approvable record of an operational change - an RFC-style workflow - instead of an unrecorded ad hoc action. See Change requests.

A widely used hardening standard for server configuration. The fleet agent runs CIS-style checks against each enrolled server and produces a hardening score. See CIS hardening.

A connected credential for a cloud provider (AWS, Azure, Google Cloud, Hetzner, and others) that lets Sencai provision and manage instances on your behalf. Also called BYOC (bring your own cloud). See Connect a cloud provider.

A virtual machine that Sencai provisions and tracks on a connected cloud account. See Provision & manage instances.

A subset of your fleet agents grouped together for a staged rollout - for example, shipping an agent software update to one cohort before the rest of your fleet. See Agent releases & cohorts.

A pattern Sencai’s intelligence layer detects across multiple alerts or services that may share a common cause, surfaced before you’d necessarily notice it manually. See Root cause analysis.

A difference between what’s recorded in your inventory and what’s actually running at the provider - for example, a resource someone changed directly at the provider instead of through Sencai. See Inventory.

Just-in-time elevation: a time-limited grant of additional access that’s requested and approved for a specific window, rather than a standing permission held indefinitely. See Access management.

A one-time credential you generate for your organization and use to register a new fleet agent on a server. See Install & enroll an agent.

A compiled set of records - configuration, scan results, audit history - assembled to support a compliance requirement such as NIS2. See NIS2.

The set of servers, cloud instances or your own hardware, running the Sencai fleet agent. See Fleet.

A detected problem, often correlated from one or more alerts, tracked from detection through investigation to resolution. See Incidents.

A resource or asset Sencai has discovered or is tracking for your organization, whether or not Sencai actively manages it. See Inventory.

A map of how your services and infrastructure depend on each other, built from what Sencai already knows about your environment. See Knowledge graph.

A cloud resource - an instance, managed database, storage bucket, or DNS zone - that Sencai actively manages and that counts against your organization’s plan limits, as opposed to something Sencai is merely aware of. See Core concepts.

A cross-tenant relationship that lets one organization manage infrastructure for another, with its own scoped access and audit trail, instead of sharing one set of credentials across customers. See Agency.

Your team’s shared workspace. Instances, fleet agents, billing, and most settings belong to an organization, not to an individual user. See Organizations & teams.

A plan tied to you as an individual rather than to any organization - it governs how many organizations you may own, how many members each of them may have, and your own AI-assisted features. See Personal plans.

A rule Sencai evaluates and can enforce automatically - for example, a network access policy or a compliance control. See Policies.

Isolating a server’s outbound network traffic at the OS level, typically because it’s suspected of being compromised, without requiring direct or SSH access to it. See Quarantine.

An AI-assisted suggestion for what actually caused an incident, based on the alerts and changes surrounding it. See Root cause analysis.

A geographic location where your cloud instances - or platform data - can be placed, chosen for latency or data-residency reasons. See Regions & data residency.

A pre-written operational script - a service restart, log collection, or similar routine task - that can be triggered against an enrolled fleet agent instead of being run by hand. See Runbooks.

An identity-provisioning standard that lets your identity provider automatically create, update, and remove Sencai users as your organization’s own directory changes. See SCIM.

A credential or API key that Sencai’s scanning detected exposed somewhere it shouldn’t be, such as a code repository. See Secret findings.

A budget limit you set for your organization’s cloud spend, with Sencai alerting once it’s approached or reached. See Spend caps.

A scheduled, automated probe - an HTTP request, for example - that verifies a service is actually reachable and responding correctly, independent of your own real traffic. See Synthetic monitoring.

Rules and reporting around how your cloud resources are tagged, used to attribute cost accurately across teams, projects, or environments. See Cost allocation.

The subscription level your organization - or you personally - is on, which determines limits and which features are available. See Plans.

A background monitor that checks a connected identity provider, such as Google Workspace or Microsoft Entra ID, for security-relevant changes and surfaces them proactively rather than waiting for you to notice. See Identity watchdog.