FAQ

General

Q: Does BlueSentinel require internet access?

No. BlueSentinel is fully self-hosted. Agents only need network access to your central server (port 5100). No internet connectivity required.

Q: What happens if the server goes down?

Agents continue enforcing the last-known policy from their local policy.json. Alerts are queued to disk and pushed when the server is back online.

Q: Can users bypass the agent?

The 4-layer anti-tamper system (dual watchdog, self-healing, file locking, OS service protection) makes it extremely difficult to bypass. The anti-tamper loop checks and repairs every 10 seconds.

Installation

Q: Do I need to install anything on each device?

Yes, a lightweight Python agent (~30 MB) runs on each endpoint. Installation takes under 2 minutes per device.

Q: Can I deploy via MDM or Group Policy?

Yes. Package the installer as an MSI (Windows) or use the shell script with MDM (macOS). Pre-configure the server URL and enrollment token.

Q: Does the agent work on Linux?

Not yet. Linux agent support is on the roadmap.

Configuration

Q: Can I allow specific USB devices?

Yes. Whitelist USB devices by serial number, vendor ID, or product ID via the admin dashboard or policy configuration.

Q: Can I set different policies for different teams?

Yes. Create device groups (e.g., Engineering, Sales, Executives) and assign different policies to each group. Policies support hierarchical inheritance.

Q: Can I temporarily allow a blocked action for a user?

Yes. Use User Exceptions to create time-bounded overrides. For example, allow a specific user to use USB for 24 hours.

Security

Q: Where are recovery keys stored?

On your server, in your PostgreSQL database. Keys are AES-encrypted before storage. Only admin users can view them, and every access is logged.

Q: Is the agent communication encrypted?

Yes. All agent-to-server communication uses HTTPS/TLS. API keys are hashed with SHA-256.

Q: Can the agent be uninstalled by end users?

No, not under normal circumstances. The agent is protected by OS-level service registration, file locking, dual watchdog processes, and self-healing. Uninstallation requires admin dashboard authorization first.

Performance

Q: How much RAM does the agent use?

Approximately 50 MB under normal operation.

Q: Does the browser proxy slow down browsing?

The MITM proxy (port 8889) adds minimal latency for most browsing. Heavy file upload sites may see slight delays as the proxy inspects the traffic.

Q: How many devices can one server handle?

A single server with 4 cores and 4 GB RAM can comfortably handle 500+ devices. For 1000+, increase the Gunicorn worker count and PostgreSQL connection pool.