ProsentriqDocumentation
The short version. The full reference ships in the repository under docs/, and the API serves its OpenAPI spec at /v2/openapi.json.
Install & operate
Create an enrollment key in the console (Settings → Sensors), then on a Linux host (Debian/Ubuntu, RHEL/Alma/Rocky/Fedora, Amazon Linux; kernel 5.4+; x86_64 or ARM64):
| Flag | Purpose |
|---|---|
--enroll-key | Enrollment key (validated before any change to the host). Leave it out to be asked for it with input hidden, so it never appears in the process list |
--enroll-key-file FILE | Read the enrollment key from a file instead |
--iface | Interface for the XDP probe (default: the default-route interface) |
--package FILE | Install a local .deb/.rpm instead of the signed repository (air-gapped) |
--api-base URL | Your self-hosted control plane |
--dry-run | Validate everything and print the plan; change nothing |
Kubernetes: helm install prosentriq-agent prosentriq/prosentriq-agent --set enrollKey=psqe_xxxx (DaemonSet with pod, namespace and image attribution). Log sources: prosentriq-sensor relay (syslog, CEF, Suricata EVE, sshd). AWS: prosentriq-sensor cloud --kind vpc-flow|cloudtrail.
On a host:
Enforcement and autonomy are switched per host from the console; the host applies the change on its next heartbeat.
API & event schema
Base URL https://api.prosentriq.com (or your instance). Authenticate with Authorization: Bearer psq_live_… (scoped API key) or a sensor token.
| Route | Purpose |
|---|---|
POST /v2/events | Ingest up to 1,000 OCSF-aligned events per batch (gzip ok, idempotent per metadata.uid) |
GET /v2/incidents, /v2/incidents/{id}/storyline | Incidents and their explained timelines |
GET /v2/decisions | The decision ledger, enforced and counterfactual |
POST /v2/actions, /v2/actions/{id}/undo | Manual response and one-click undo |
POST /v2/soar/actions | Signed inbound actions from SOAR playbooks |
POST /v2/rules/import | Import Sigma or Falco rules |
POST /v2/compliance/evidence-packs | Generate a signed evidence pack |
GET /v2/public/schema | The canonical event JSON Schema |
Existing v1 agents keep working: /v1/* is a frozen compatibility API. Build your own sensor with the Python SDK: pip install prosentriq-sdk.
Architecture, in short
Sensors (the XDP/eBPF engine, the Kubernetes DaemonSet, log relays, cloud collectors, your SDK sensors) send canonical events to one ingest door. The control plane scores them with explainable reasons, groups them into incidents, and decides through the Autonomy Dial. Every decision is ledgered; enforced actions return to hosts as directives on their heartbeat, and hosts keep a local circuit breaker so they stay safe while offline. The full design is in docs/architecture/ARCHITECTURE.md.