Centinela — User guide · Guía de usuario

EN first, ES below. Everything you see is explainable: every number has a Why? panel with the rule, the graph query, the evidence and the policy version.

Navigation

Hoy (Today) · Vulnerabilidades · Activos · Planes · Campañas · Informes · Conectores · Ajustes — collapsible sidebar; ⌘K opens the command palette (navigate, search a CVE/package/asset, run allowed actions, ask in natural language — the generated CQL is always shown and editable).

Today

One sentence of status ("3 vulnerabilities need your decision today"), the actions pending for your role, active zero-days and the exposure trend. Nothing else by default; density is adjustable.

Does it affect me? (¿Me afecta?)

Type a CVE, GHSA, PURL or package name. You get a large verdict — Affected / Not affected / Investigating — then the evidence: affected assets, exposure path (internet → load balancer → workload → image → package → repository → owner), compensating controls that already mitigate, and coverage gaps that would change the answer.

Vulnerabilities (inbox)

Filters: priority, KEV, EPSS, exposure, environment, owner, status, SLA. Default view shows only what needs action today, grouped by root cause (one base image fix closing 312 findings is one row). Each row → timeline: publication → ingestion → matching → plan → approval → PR → deployment → verified.

Plans and approval

A plan is a signed proposal: findings, root cause, actions from a closed catalog, mitigations, verification steps, rollback, blast radius, hash. Approval flow: Summary → Evidence → Diff → Risk & rollback → Confirm. You cannot approve without opening the diff. Confirm = hold-to-confirm ring, then WebAuthn (security key / Face ID / fingerprint). P0/P1 require a comment; P0 in production requires two different approvers, one of them a security lead. Options: approve · reject (reason) · request changes (new version) · accept risk (security lead, expiry) · postpone to maintenance window.

What happens next: an isolated executor re-verifies everything and opens a pull request. Centinela never merges; your repository's review rules apply. The finding closes only when the matcher verifies the vulnerable version is gone.

War Room (zero-day)

When a KEV or critical advisory arrives, a real-time page shows the timeline, assets as they are confirmed, mitigations, plans and each owner's status.

Campaigns, reports, benchmarks

Campaigns ("OpenSSL October") track scope, owners, target date, burndown and MTTR. Reports (weekly executive, per incident, ISO 27001 / SOC 2 evidence) use the same queries as the UI; each figure carries its query. Team benchmarks are for improvement, not blame.

Connector health

Per source and account/project/repo: status, last success, readable error, probable cause, fix, retry button. Missing coverage is always visible and affects verdicts ("investigating").

Roles

viewer · analyst (triage, comment, request re-analysis; risk acceptance needs a security lead) · service_owner (approve plans for owned services) · security_lead (approve anything, accept risk, policies) · platform_admin (connectors, tenants, integrations — cannot approve) · auditor (read-only incl. audit log) · break_glass (emergency, double approval).

---

Guía de usuario (ES)

Navegación: Hoy · Vulnerabilidades · Activos · Planes · Campañas · Informes · Conectores · Ajustes. ⌘K abre la paleta de comandos (buscar CVE/paquete/activo, consultas en lenguaje natural con la CQL generada visible y editable).

Hoy: una frase de estado, tus acciones pendientes según rol, zero-days activas y tendencia de exposición.

¿Me afecta?: escribe un CVE/GHSA/paquete; veredicto grande (Afectado / No afectado / Investigando) y debajo la evidencia: activos, ruta de exposición, controles que ya mitigan y huecos de cobertura.

Vulnerabilidades: bandeja con filtros (prioridad, KEV, exposición, entorno, owner, estado, SLA), agrupada por causa raíz; cada hallazgo tiene línea temporal y panel ¿Por qué? con regla, consulta, evidencias, pesos y versión de política.

Planes y aprobación: Resumen → Evidencia → Diff → Riesgo y rollback → Confirmación. No se puede aprobar sin abrir el diff. Confirmar = mantener pulsado + WebAuthn. P0/P1 exigen comentario; P0 en producción exige dos aprobadores distintos (uno security_lead). Tras aprobar, el executor aislado vuelve a verificar todo y abre un pull request; Centinela nunca hace merge. El hallazgo se cierra solo cuando el matcher verifica que la versión vulnerable ya no corre.

War Room: vista en tiempo real por zero-day. Campañas e informes: mismas consultas que la UI, cada cifra con su consulta. Salud de conectores: error legible, causa probable y solución; la cobertura que falta siempre es visible.