Glossary
An alphabetical reference for the product vocabulary used throughout the app and this documentation site. If a term links to a page, that page has the full detail.
The Sencai fleet agent - software installed on a server (cloud or on-premise) that reports inventory, patch, and security status back to Sencai, and enables runbooks and remote execution on that server. See Fleet agent.
Approval
Section titled “Approval”A pending action that requires sign-off from an authorized user before it proceeds, rather than executing immediately - used for privileged requests like just-in-time elevation. See Approvals.
Audit event
Section titled “Audit event”A single entry in Sencai’s append-only audit trail: who did what, when, and to what. Every mutating action across the platform is recorded this way. See Audit log.
Blueprint
Section titled “Blueprint”A reusable infrastructure template you define once and deploy repeatedly, instead of provisioning the same set of resources by hand each time. See Blueprints & catalog.
Catalog instance
Section titled “Catalog instance”A resource created by deploying a blueprint, tracked as its own record separate from resources provisioned directly. See Blueprints & catalog.
Change request
Section titled “Change request”A tracked, approvable record of an operational change - an RFC-style workflow - instead of an unrecorded ad hoc action. See Change requests.
CIS benchmark
Section titled “CIS benchmark”A widely used hardening standard for server configuration. The fleet agent runs CIS-style checks against each enrolled server and produces a hardening score. See CIS hardening.
Cloud account
Section titled “Cloud account”A connected credential for a cloud provider (AWS, Azure, Google Cloud, Hetzner, and others) that lets Sencai provision and manage instances on your behalf. Also called BYOC (bring your own cloud). See Connect a cloud provider.
Cloud instance
Section titled “Cloud instance”A virtual machine that Sencai provisions and tracks on a connected cloud account. See Provision & manage instances.
Cohort
Section titled “Cohort”A subset of your fleet agents grouped together for a staged rollout - for example, shipping an agent software update to one cohort before the rest of your fleet. See Agent releases & cohorts.
Correlation
Section titled “Correlation”A pattern Sencai’s intelligence layer detects across multiple alerts or services that may share a common cause, surfaced before you’d necessarily notice it manually. See Root cause analysis.
A difference between what’s recorded in your inventory and what’s actually running at the provider - for example, a resource someone changed directly at the provider instead of through Sencai. See Inventory.
Elevation (JIT)
Section titled “Elevation (JIT)”Just-in-time elevation: a time-limited grant of additional access that’s requested and approved for a specific window, rather than a standing permission held indefinitely. See Access management.
Enrollment token
Section titled “Enrollment token”A one-time credential you generate for your organization and use to register a new fleet agent on a server. See Install & enroll an agent.
Evidence pack
Section titled “Evidence pack”A compiled set of records - configuration, scan results, audit history - assembled to support a compliance requirement such as NIS2. See NIS2.
The set of servers, cloud instances or your own hardware, running the Sencai fleet agent. See Fleet.
Incident
Section titled “Incident”A detected problem, often correlated from one or more alerts, tracked from detection through investigation to resolution. See Incidents.
Inventory item
Section titled “Inventory item”A resource or asset Sencai has discovered or is tracking for your organization, whether or not Sencai actively manages it. See Inventory.
Knowledge graph
Section titled “Knowledge graph”A map of how your services and infrastructure depend on each other, built from what Sencai already knows about your environment. See Knowledge graph.
Managed resource
Section titled “Managed resource”A cloud resource - an instance, managed database, storage bucket, or DNS zone - that Sencai actively manages and that counts against your organization’s plan limits, as opposed to something Sencai is merely aware of. See Core concepts.
MSP / agency relationship
Section titled “MSP / agency relationship”A cross-tenant relationship that lets one organization manage infrastructure for another, with its own scoped access and audit trail, instead of sharing one set of credentials across customers. See Agency.
Organization
Section titled “Organization”Your team’s shared workspace. Instances, fleet agents, billing, and most settings belong to an organization, not to an individual user. See Organizations & teams.
Personal plan
Section titled “Personal plan”A plan tied to you as an individual rather than to any organization - it governs how many organizations you may own, how many members each of them may have, and your own AI-assisted features. See Personal plans.
Policy
Section titled “Policy”A rule Sencai evaluates and can enforce automatically - for example, a network access policy or a compliance control. See Policies.
Quarantine
Section titled “Quarantine”Isolating a server’s outbound network traffic at the OS level, typically because it’s suspected of being compromised, without requiring direct or SSH access to it. See Quarantine.
RCA (root cause analysis)
Section titled “RCA (root cause analysis)”An AI-assisted suggestion for what actually caused an incident, based on the alerts and changes surrounding it. See Root cause analysis.
Region
Section titled “Region”A geographic location where your cloud instances - or platform data - can be placed, chosen for latency or data-residency reasons. See Regions & data residency.
Runbook
Section titled “Runbook”A pre-written operational script - a service restart, log collection, or similar routine task - that can be triggered against an enrolled fleet agent instead of being run by hand. See Runbooks.
An identity-provisioning standard that lets your identity provider automatically create, update, and remove Sencai users as your organization’s own directory changes. See SCIM.
Secret finding
Section titled “Secret finding”A credential or API key that Sencai’s scanning detected exposed somewhere it shouldn’t be, such as a code repository. See Secret findings.
Spend cap
Section titled “Spend cap”A budget limit you set for your organization’s cloud spend, with Sencai alerting once it’s approached or reached. See Spend caps.
Synthetic check
Section titled “Synthetic check”A scheduled, automated probe - an HTTP request, for example - that verifies a service is actually reachable and responding correctly, independent of your own real traffic. See Synthetic monitoring.
Tag governance
Section titled “Tag governance”Rules and reporting around how your cloud resources are tagged, used to attribute cost accurately across teams, projects, or environments. See Cost allocation.
The subscription level your organization - or you personally - is on, which determines limits and which features are available. See Plans.
Watchdog
Section titled “Watchdog”A background monitor that checks a connected identity provider, such as Google Workspace or Microsoft Entra ID, for security-relevant changes and surfaces them proactively rather than waiting for you to notice. See Identity watchdog.
What’s next
Section titled “What’s next”- FAQ - common questions with quick answers
- Core concepts - how these terms fit together
- Troubleshooting