diff --git a/docs/features/audit-log.mdx b/docs/features/audit-log.mdx index d2740618..92e72257 100644 --- a/docs/features/audit-log.mdx +++ b/docs/features/audit-log.mdx @@ -4,14 +4,14 @@ description: Track every mutating action on your Sencho instance with a searchab --- - The Audit Log requires a Sencho **Admiral** license. + The recent-activity audit log, scoped to the last 14 days, is available on every tier. CSV and JSON export, anomaly detection, and configurable retention beyond the recent window require a Sencho **Admiral** license. Audit is hub-only and is hidden from the nav strip when a remote node is the active selection. See [Multi-Node Management](/features/multi-node#what-top-level-views-show-when-a-remote-node-is-active). -Sencho Admiral records every mutating action (deploy, stop, delete, settings changes, user management) with full attribution. The audit log answers the question every team eventually asks: **"Who changed what, and when?"** +Sencho records every mutating action (deploy, stop, delete, settings changes, user management) with full attribution. The audit log answers the question every team eventually asks: **"Who changed what, and when?"** ## What gets logged @@ -64,7 +64,7 @@ Expanding a row in the Table view reveals additional detail: ## Viewing the audit log -Navigate to the **Audit** tab in the sidebar. The tab is visible on Admiral to users with the **Admin** or **Auditor** role. +Navigate to the **Audit** tab in the sidebar. The tab is available to users whose role grants the `system:audit` permission, which by default means **Admin** or **Auditor**. On every tier the feed is scoped to the last 14 days; the full retention window, along with export and anomaly detection, comes with Admiral. The page has two views, toggled from the segmented control in the card header: **Stream** (default) and **Table**. The card subtitle reports the total number of entries that match the current filters. @@ -105,6 +105,10 @@ Both views share the **Refresh** button and the **Export** dropdown in the card ## Anomaly detection + + Anomaly detection requires a Sencho **Admiral** license. + + In Stream view, Sencho annotates individual entries with lightweight anomaly flags that help you spot activity that deviates from an actor's normal pattern. Flags appear inline in the entry's meta line, after the IP address. | Flag | When it fires | @@ -129,6 +133,10 @@ All filters AND together and are applied server-side with pagination. ## Export + + CSV and JSON export require a Sencho **Admiral** license. + + Export the currently filtered audit log as **CSV** or **JSON** using the **Export** dropdown in the card header. The export respects every active filter, so you can narrow down to a date range or specific user before exporting. Exports are capped at 10,000 entries per download. To export a larger window, narrow the date range and download in chunks. @@ -148,7 +156,11 @@ To create an Auditor user, go to **Settings · Users** and select the **Auditor* ## Configurable data retention -Audit log entries are automatically pruned based on your configured retention period. The default is **90 days**. + + Every tier can read the most recent 14 days of activity. Configurable retention beyond that window requires a Sencho **Admiral** license. + + +On Admiral, audit log entries are automatically pruned based on your configured retention period. The default is **90 days**. To change the retention period: @@ -170,7 +182,7 @@ Sensitive database values (such as remote node API tokens) are encrypted at rest - The Audit log requires an **Admiral** license, and the tab is shown only to users whose role grants the `system:audit` permission. By default that means **Admin** or **Auditor**. If you are signed in as a Deployer or Viewer on an Admiral instance, ask an admin to assign you the Auditor role from **Settings · Users**. + The Audit tab is shown to users whose role grants the `system:audit` permission. By default that means **Admin** or **Auditor**. If you are signed in as a Deployer or Viewer, ask an admin to assign you the Auditor role from **Settings · Users**. The recent-activity feed is available on every tier; export, anomaly detection, and retention beyond the recent window come with Admiral. Filters live in **Table view only**. Toggle the segmented control in the card header from **Stream** to **Table** and the search box, method dropdown, and From / To date pickers will appear above the grid. Switching back to Stream clears the filter strip but does not remember the last filter. diff --git a/docs/features/licensing.mdx b/docs/features/licensing.mdx index 1f2318b6..615efcb0 100644 --- a/docs/features/licensing.mdx +++ b/docs/features/licensing.mdx @@ -23,7 +23,7 @@ See [the pricing page](https://sencho.io/pricing) for current pricing. **Community** is the complete self-hosted control plane. It includes: - Unlimited nodes, the Monaco compose editor, the full stack file explorer (browse, view, edit, upload, download, rename, chmod, delete; admin role for writes), and the App Store with 199+ one-click templates -- Real-time container stats, global logs, the interactive network topology graph, and stack labels +- Real-time container stats, global logs, the interactive network topology graph (Hub, Grouped, and Free layouts), node labels, and stack labels - Git sources for compose stacks - Multi-node management in both Proxy and Pilot Agent modes - Fleet View with search, sort, filter, and node-card drill-down @@ -35,7 +35,9 @@ See [the pricing page](https://sencho.io/pricing) for current pricing. - Scheduled operations across the full action catalog (lifecycle, updates, scans, snapshots, prune) - Webhooks (incoming, to trigger deploys from CI/CD) and notification routing (per-stack and per-category rules to Discord, Slack, or any webhook) - Custom S3-compatible backup target (bring your own AWS S3, Cloudflare R2, MinIO, Backblaze B2, or Wasabi bucket) -- Vulnerability scanning: install, update, and uninstall Trivy, on-demand scans for vulnerabilities, secrets, and misconfigurations, scan comparison, and CVE suppressions +- Vulnerability scanning: install, update, uninstall, and auto-update the managed Trivy binary, on-demand scans for vulnerabilities, secrets, and misconfigurations, scan comparison, CVE suppressions, and single-scan SBOM export (SPDX, CycloneDX) +- Private registry credentials for Docker Hub, GitHub Container Registry (GHCR), and custom or self-hosted registries (admin role required) +- A 14-day recent-activity audit log with Stream and Table views and filtering - Alert rules with Discord, Slack, and webhook targets - API tokens for CI/CD pipelines and scripts (admin role required) - Unlimited accounts with the Admin and Viewer roles @@ -44,9 +46,9 @@ See [the pricing page](https://sencho.io/pricing) for current pricing. **Admiral** adds governance, security, and fleet control for teams. It includes everything in Community, plus: -- **Governance:** advanced RBAC roles (Deployer, Node Admin, Auditor), scoped permissions per stack or node, and the audit log with CSV export -- **Security:** Fleet Secrets, private and custom registry credentials, deploy enforcement (scan policies with `block_on_deploy`), SBOM (SPDX, CycloneDX) and SARIF export, auto-update of the managed Trivy binary, and LDAP / Active Directory authentication -- **Fleet operations:** node labels, node cordon, Blueprints, and Sencho Mesh (cross-node container networking) +- **Governance:** advanced RBAC roles (Deployer, Node Admin, Auditor), scoped permissions per stack or node, and audit log export (CSV, JSON), anomaly detection, and configurable retention beyond the recent window +- **Security:** Fleet Secrets, AWS ECR registry credentials, deploy enforcement (scan policies with `block_on_deploy`), SARIF export, and LDAP / Active Directory authentication +- **Fleet operations:** node cordon, Blueprints, and Sencho Mesh (cross-node container networking) - **Managed continuity:** Sencho Cloud Backup (a managed, off-site snapshot allowance) - **Operator access:** the Host Console (a browser-based terminal on the Sencho host) diff --git a/docs/features/multi-node.mdx b/docs/features/multi-node.mdx index 0a088fd1..ad2f4136 100644 --- a/docs/features/multi-node.mdx +++ b/docs/features/multi-node.mdx @@ -169,7 +169,7 @@ The Nodes table surfaces routing, status, and per-node automation at a glance fo | **Mode** | `-` for the local node; `Proxy` or `Pilot Agent` badge for remotes, with an icon matching the mode. | | **Endpoint** | `docker.sock` for local; the full Sencho API URL for proxy nodes; `tunnel (seen X ago)` or `tunnel (waiting)` for pilot agents. | | **Status** | `Online`, `Offline`, or `Unknown` badge. | -| **Labels** | Per-node label palette. On Admiral the cell shows the picker (an empty cell reads `No labels` with an Add label control); on Community the cell shows a single dash. | +| **Labels** | Per-node label palette. The cell shows the label picker; an empty cell reads `No labels` with an Add label control. | | **Schedules** | Number of active scheduled tasks targeting this node, plus a `next X` countdown to the next run. Click the count or the calendar icon in the Actions column to filter the Schedules view to that node. | | **Updates** | `Auto` if at least one enabled `Auto-update Stack` or `Auto-update All Stacks` schedule targets the node; `Off` otherwise. A pulsing dot and count appear when stacks have pending image updates. | | **Actions** | **View Schedules**, **Test Connection**, **Edit Node**, and **Delete Node** icon buttons. The local row hides Delete because the local node cannot be removed. | diff --git a/docs/features/overview.mdx b/docs/features/overview.mdx index 4472b1e0..d75d62aa 100644 --- a/docs/features/overview.mdx +++ b/docs/features/overview.mdx @@ -87,7 +87,7 @@ Route alerts to specific channels with per-stack routing rules. Send production ### Audit log -Track every mutating action across your Sencho instance with a searchable audit trail. See who deployed, stopped, deleted, or changed settings, with timestamps, user attribution, and node context. Admiral only. [Learn more →](/features/audit-log) +Track every mutating action across your Sencho instance with a searchable audit trail. See who deployed, stopped, deleted, or changed settings, with timestamps, user attribution, and node context. The recent 14-day window is available on every tier; export, anomaly detection, and extended retention come with Admiral. [Learn more →](/features/audit-log) ## Fleet & Multi-Node @@ -159,7 +159,7 @@ Generate scoped API tokens for CI/CD pipelines, scripts, and automation workflow ### Vulnerability scanning -Scan container images for known CVEs with [Trivy](https://trivy.dev). Install Trivy with one click from Settings → Security → Vulnerability Scanning on first use; the [setup guide](/operations/trivy-setup) covers bind-mounted and air-gapped alternatives. Manual scanning, secret and misconfiguration detection, scan comparison, scheduled scans, and CVE suppressions are available on every tier; scan policies that gate deploys, SBOM generation, SARIF export, and auto-update of the managed Trivy binary are Admiral. [Learn more →](/features/vulnerability-scanning) +Scan container images for known CVEs with [Trivy](https://trivy.dev). Install Trivy with one click from Settings → Security → Vulnerability Scanning on first use; the [setup guide](/operations/trivy-setup) covers bind-mounted and air-gapped alternatives. Manual scanning, secret and misconfiguration detection, scan comparison, scheduled scans, CVE suppressions, single-scan SBOM export, and auto-update of the managed Trivy binary are available on every tier; scan policies that gate deploys and SARIF export are Admiral. [Learn more →](/features/vulnerability-scanning) ### CVE suppressions @@ -167,7 +167,7 @@ Accept known-benign vulnerabilities so scan results stay focused on findings tha ### Private registries -Store credentials for private Docker registries: Docker Hub organizations, GHCR, AWS ECR, and self-hosted registries. Sencho injects them automatically during deploy and pull operations. ECR short-lived tokens are refreshed on every operation. Admiral only. [Learn more →](/features/private-registries) +Store credentials for private Docker registries: Docker Hub organizations, GHCR, and self-hosted registries on every tier, plus AWS ECR on Admiral. Sencho injects them automatically during deploy and pull operations. ECR short-lived tokens are refreshed on every operation. [Learn more →](/features/private-registries) ## Automation @@ -201,4 +201,4 @@ When you manage multiple nodes running different Sencho versions, the dashboard ### Licensing & billing -Community is the complete self-hosted control plane, free forever. Admiral adds governance, security, and fleet control for teams: advanced RBAC, the audit log, Fleet Secrets, deploy enforcement, Blueprints, Sencho Mesh, and more. Manage your license, view subscription details, and access the billing portal from Settings. [Learn more →](/features/licensing) +Community is the complete self-hosted control plane, free forever. Admiral adds governance, security, and fleet control for teams: advanced RBAC, audit log export and retention, Fleet Secrets, deploy enforcement, Blueprints, Sencho Mesh, and more. Manage your license, view subscription details, and access the billing portal from Settings. [Learn more →](/features/licensing) diff --git a/docs/features/private-registries.mdx b/docs/features/private-registries.mdx index c4a581e1..f5b0b3bc 100644 --- a/docs/features/private-registries.mdx +++ b/docs/features/private-registries.mdx @@ -4,7 +4,7 @@ description: Store credentials for private Docker registries so Sencho can authe --- - Private Registries is an **Admiral** tier, admin-only feature. Each Sencho instance stores its own registry credentials; the Registries section is hidden when you are viewing another node through the node switcher. + Private Registries is an admin-only feature. Credentials for Docker Hub, GitHub Container Registry (GHCR), and custom or self-hosted registries are available on every tier; AWS ECR requires a Sencho **Admiral** license. Each Sencho instance stores its own registry credentials; the Registries section is hidden when you are viewing another node through the node switcher. Sencho stores credentials for your private Docker registries and injects them automatically whenever it runs `docker compose pull` or `docker compose up`. Stacks can reference private images without anyone having to run `docker login` on the host. @@ -19,9 +19,11 @@ Sencho stores credentials for your private Docker registries and injects them au |------|-------------|-------------| | **Docker Hub** | Private Docker Hub organizations and repositories | Username + access token | | **GitHub Container Registry (GHCR)** | `ghcr.io` images for users and organizations | GitHub username + personal access token (PAT) | -| **AWS Elastic Container Registry (ECR)** | Amazon ECR private registries | AWS Access Key ID + Secret Access Key (+ region) | +| **AWS Elastic Container Registry (ECR)** | Amazon ECR private registries (Admiral) | AWS Access Key ID + Secret Access Key (+ region) | | **Custom / Self-hosted** | Any Docker V2 compatible registry | Username + password or token | +AWS ECR requires a Sencho **Admiral** license; Docker Hub, GHCR, and custom registries are available on every tier. + ## Where to find it Open **Settings → Infrastructure → Registries** on the Sencho instance you are signed into directly. The section is hidden when you are viewing another node through the node switcher. @@ -154,7 +156,7 @@ AWS ECR uses short-lived authentication tokens (valid for 12 hours) derived from - **Encrypted storage.** Registry secrets are encrypted at rest with the same encryption layer used for remote-node tokens and SSO secrets. - **No persistent Docker login.** Credentials are written to a temporary file for the duration of each compose operation and deleted afterward. - **Secrets never exposed.** The API never returns decrypted secrets. The UI shows only whether a secret is stored. -- **Admin role required.** Registry management is restricted to admin operators, even on Admiral. Viewers and operators with non-admin roles cannot see the section. +- **Admin role required.** Registry management is restricted to admin operators. Viewers and operators with non-admin roles cannot see the section. - **API tokens cannot manage registries.** Registry credentials can only be created, edited, or deleted from an admin browser session. Automation tokens are scoped away from this surface so a leaked CI key cannot rewrite pull credentials. - **Audit trail.** Registry create, update, and delete operations are recorded in the [Audit Log](/features/audit-log). @@ -184,7 +186,7 @@ Because the Registries section is hidden when you view another node through the - The section is shown on the instance you are signed into directly, and only when that instance's license is Admiral and the signed-in operator has the admin role. On a remote node viewed through the node switcher, the section is hidden by design; sign into that node's own Sencho instance to manage its registries. If a non-admin operator should be able to manage registries, change their role under **Settings → Access → Users** first. + The section is shown on the instance you are signed into directly, to operators with the admin role. On a remote node viewed through the node switcher, the section is hidden by design; sign into that node's own Sencho instance to manage its registries. If a non-admin operator should be able to manage registries, change their role under **Settings → Access → Users** first. Adding an **AWS ECR** registry requires Admiral; Docker Hub, GHCR, and custom registries are available on every tier. diff --git a/docs/features/vulnerability-scanning.mdx b/docs/features/vulnerability-scanning.mdx index 2578337a..bb94d196 100644 --- a/docs/features/vulnerability-scanning.mdx +++ b/docs/features/vulnerability-scanning.mdx @@ -3,7 +3,7 @@ title: "Vulnerability Scanning" description: "Scan container images and stack compose files for CVEs, secrets, and misconfigurations. Surface severity badges in the Resources Hub, compare scans over time, and gate deploys on policy violations." --- -Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. Manual scanning, secret and misconfig detection, scan history, comparison, scheduled fleet scans, and CVE suppressions are available on every tier. Admiral adds policy enforcement, SBOM, and SARIF exports. +Sencho integrates with [Trivy](https://trivy.dev) to scan container images and Compose files for vulnerabilities (CVEs), hardcoded secrets, and misconfigurations. Findings surface as severity badges in the Resources Hub and as drillable reports in the scan drawer. Manual scanning, secret and misconfig detection, scan history, comparison, scheduled fleet scans, CVE suppressions, single-scan SBOM export, and managed Trivy auto-update are available on every tier. Admiral adds policy enforcement and SARIF export. Resources Hub Images table with severity badges (CRITICAL, HIGH, MEDIUM) on managed image rows alongside the Scan history button @@ -35,9 +35,9 @@ The Trivy CLI must be available on the machine running Sencho. Trivy is not bund | Scheduled fleet scans (all images on a node) | ✓ | ✓ | | Scan policies with `block_on_deploy` enforcement | | ✓ | | Suppression-aware deploy blocking (optional toggle) | | ✓ | -| SBOM generation (SPDX, CycloneDX) | | ✓ | +| SBOM generation (SPDX, CycloneDX) | ✓ | ✓ | | SARIF export (code scanning integration) | | ✓ | -| Auto-update of the managed Trivy binary | | ✓ | +| Auto-update of the managed Trivy binary | ✓ | ✓ | ## On-demand scanning @@ -77,7 +77,7 @@ The drawer opens as a right-side sheet with the breadcrumb `Security › Scans - **CSV**: export the full vulnerability list for offline review. - **SARIF**: download the full scan (vulnerabilities, secrets, and misconfigs) as SARIF 2.1.0 for upload to GitHub code scanning or any SARIF-aware tool. Admiral required. -The summary header below the actions reports the per-severity counts, the total, how many findings have a fix available, when the scan ran, and what triggered it. An **SBOM** button below the summary downloads a Software Bill of Materials in SPDX JSON or CycloneDX format (Admiral). +The summary header below the actions reports the per-severity counts, the total, how many findings have a fix available, when the scan ran, and what triggered it. An **SBOM** button below the summary downloads a Software Bill of Materials in SPDX JSON or CycloneDX format. ### Vulnerabilities tab @@ -292,10 +292,6 @@ Acknowledged misconfigs are emitted in the SARIF export with a `suppressions` en ## SBOM generation - - SBOM generation requires an **Admiral** license. - - A Software Bill of Materials (SBOM) is a machine-readable inventory of every package in a container image. SBOMs satisfy security frameworks (SLSA, Executive Order 14028, EU Cyber Resilience Act) and support offline supply-chain analysis. From the scan results drawer, click **SBOM** below the summary and choose a format: diff --git a/docs/operations/trivy-setup.mdx b/docs/operations/trivy-setup.mdx index a8f722cb..109c4857 100644 --- a/docs/operations/trivy-setup.mdx +++ b/docs/operations/trivy-setup.mdx @@ -44,7 +44,7 @@ When a newer Trivy release is available, Settings → Security → Vulnerability To update automatically instead, toggle **Auto-update Trivy** on. Sencho checks for new releases once a day and installs them in the background. You'll get an in-app notification each time a new version is installed, or when an update is available and auto-update is off. -The install, update, and uninstall buttons are available to admins on every tier. The **Auto-update Trivy** toggle requires Admiral. +The install, update, and uninstall buttons and the **Auto-update Trivy** toggle are available to admins on every tier. ### Removing the managed install diff --git a/docs/reference/security.mdx b/docs/reference/security.mdx index 514bdc52..71a9f1d1 100644 --- a/docs/reference/security.mdx +++ b/docs/reference/security.mdx @@ -88,11 +88,14 @@ Every Sencho instance includes the foundational security stack. Advanced access- | Multi-user with RBAC (Admin, Viewer) | ✓ | ✓ | | Webhook signatures (HMAC-SHA256) | ✓ | ✓ | | API tokens (scoped, expiring) | ✓ | ✓ | -| Scan policies and SBOM generation | | ✓ | +| SBOM generation (SPDX, CycloneDX) | ✓ | ✓ | +| Recent-activity audit log (14-day window) | ✓ | ✓ | +| Scan policies (`block_on_deploy`) | | ✓ | +| SARIF export | | ✓ | | Fleet Secrets (encrypted env-var bundles) | | ✓ | | Advanced RBAC (Deployer, Node Admin, Auditor) | | ✓ | | Scoped permissions (per-stack, per-node) | | ✓ | -| Audit log with export | | ✓ | +| Audit log export, anomaly detection, and extended retention | | ✓ | ## Password authentication @@ -207,7 +210,7 @@ For user management and scoped permissions, see [RBAC & User Management](/featur Every POST, PUT, DELETE, and PATCH request to the API is recorded in the audit log with the acting username, IP address, HTTP method, response status, and an auto-generated summary. GET requests are excluded to keep the log focused on mutations. -The audit log is searchable by keyword (actions, paths, usernames) and filterable by HTTP method and date range. Results can be exported as CSV or JSON (up to 10,000 entries per export). Retention defaults to 90 days and is configurable from 1 to 365 days in **Settings · Operations · Data Retention**. +The audit log is searchable by keyword (actions, paths, usernames) and filterable by HTTP method and date range. The recent-activity log, scoped to the last 14 days, is available on every tier. With Admiral, results can be exported as CSV or JSON (up to 10,000 entries per export), entries carry anomaly annotations, and retention defaults to 90 days and is configurable from 1 to 365 days in **Settings · Operations · Data Retention**. The **Auditor** role provides read-only access to the audit log without any other administrative privileges, making it suitable for compliance reviewers who should not have access to system settings. @@ -215,7 +218,7 @@ The **Auditor** role provides read-only access to the audit log without any othe Audit log table showing recent actions with method badges and status codes -For details, see [Audit Log](/features/audit-log). Admiral tier. +For details, see [Audit Log](/features/audit-log). ## Encryption at rest diff --git a/docs/reference/settings.mdx b/docs/reference/settings.mdx index b28221a5..2c071ebe 100644 --- a/docs/reference/settings.mdx +++ b/docs/reference/settings.mdx @@ -290,7 +290,7 @@ Click **Save settings** to apply. ## Registries - Private Registries require a Sencho Admiral license. + Docker Hub, GHCR, and custom registry credentials are available on every tier. AWS ECR requires a Sencho Admiral license. **Scope:** Global, admin-only @@ -435,7 +435,7 @@ See [Stack Labels](/features/stack-labels) for the full walkthrough. ## Vulnerability Scanning - Vulnerability Scanning is admin-only. The Trivy installer and CVE/misconfig suppressions are available on all tiers; scan policies and the **Auto-update Trivy** toggle require an Admiral license (the toggle also requires a managed Trivy binary). + Vulnerability Scanning is admin-only. The Trivy installer, the **Auto-update Trivy** toggle (which also requires a managed Trivy binary), and CVE/misconfig suppressions are available on all tiers; scan policies require an Admiral license. **Scope:** Per-node @@ -453,7 +453,7 @@ Manage the Trivy scanner, scan policies, suppressions, and acknowledgements that | **Status** | `Installed (managed)` when Sencho manages the binary, `Installed (host)` when an existing host binary is being reused, or empty when nothing is detected. | | **Version** | The current Trivy version, when installed. | | **Install / Update / Uninstall** | Lifecycle actions for the managed binary. Uninstall asks for confirmation. | -| **Auto-update Trivy** toggle | When on, Sencho checks daily and installs newer Trivy releases automatically. Requires Admiral and a managed Trivy binary. | +| **Auto-update Trivy** toggle | When on, Sencho checks daily and installs newer Trivy releases automatically. Requires a managed Trivy binary. | ### Scan policies