Sentinel on a resource

The Overview tab of an App Service app, a Static Web Apps site, a Container Instances instance, a Key-Value Store and a SQL Server instance has a Sentinel card. Turning monitoring on or off needs sentinel/write in the boundary; without it the switch is not shown.

What monitoring on and off means

Sentinel looks at every workload in the boundary whatever the card says, and sends its evidence to the language model in every run. The card's setting decides only whether findings about this resource are recorded:

• Active — findings about the resource are recorded, and the card lists its four most severe Open ones, with View all findings for this resource.
• Inactive, after someone turned monitoring off — new findings about the resource are not recorded, and the ones it already has close within about an hour, because Sentinel no longer records seeing them.

Important

A resource nobody has set shows Inactive, but Sentinel records findings about it all the same: they appear on the Sentinel page, not on the card. Turn monitoring on to see them on the card, or off to stop them being recorded.

Turn monitoring on

On the Sentinel card, switch on Enable monitoring. The card shows Active.

Turn monitoring off

• Static web apps, container instances, key-value stores and SQL Server — switch off Monitoring on the card.
• Apps — open the Configuration tab, section Sentinel, switch off Enable Sentinel and save the section.

Minimum severity for an app

The app's Sentinel configuration section also has Minimum Alert Severity: findings about the app below the chosen severity are not recorded. Switching monitoring on from the card clears the minimum severity, so set it afterwards. Findings Retention Period is stored but not used; findings are kept as described in Closing, reopening and deletion.

With the CLI

stsh sentinel resource app my-app --boundary my-boundary
stsh sentinel resource app my-app --set enabled=true --set minimumSeverity=High --boundary my-boundary

The first lists the resource's findings; --set writes its setting. The resource type is app, staticwebapp, containerinstance, valkey or sqlservercluster, and the id is the resource's name. A write replaces the whole setting: leave out enabled=true and monitoring is turned off.