Sentinel Risk Configuration
Fine-tuning risk scores, weights, and decision thresholds.
Sentinel Configuration
Sentinel allows you to "train" the risk engine based on your specific security needs. You can decide how much weight to assign to various security events.
Authentication factors
The first settings card controls the delegated authentication services:
- Time-based OTP enables rotating TOTP verification codes.
- Passkeys enables phishing-resistant WebAuthn authentication.
- Email magic links enables delegated passwordless email authentication.
Magic-link details remain collapsed until the factor is enabled. Before saving an enabled configuration, register at least one exact HTTPS callback URL. The allowlist may be empty only while magic links are disabled.
| Magic-link setting | Allowed value | Default |
|---|---|---|
| Link lifetime | 120–1800 seconds | 600 seconds |
| Resend cooldown | 0–900 seconds | 60 seconds |
| Request limit window | 300–86400 seconds | 3600 seconds |
| Maximum requests per window | 1–20 | 5 |
| Maximum verification attempts | 3–20 | 8 |
| Callback allowlist | Up to 20 exact HTTPS URLs | Empty while disabled |
See Delegated Email Magic Links for the trust model and application responsibilities.
Score Adjustments (Weights)
Every suspicious event adds a value to the total Risk Score (from 0.0 to 1.0). You can adjust the following parameters:
- Malware/Threat IP Flag: High risk score for IPs found in global blacklists.
- TOR/VPN Flag: Risk associated with anonymizing networks.
- Unknown IP / Country: Extra risk added when a user logs in from a location or IP never seen before.
- New User Agent: Risk for using a new browser or hardware.
Risk Reduction
- Session Continuity Reduction: This negative value reduces the risk score if the user maintains a stable, known session. This is vital for avoiding "false positives" during normal app usage.
Decision Thresholds
Define the limits at which Sentinel recommends an action to the integrating application:
| Threshold | Description |
|---|---|
| Challenge MFA Threshold | If the score is >= this value, Sentinel recommends a stronger factor. |
| Deny Threshold | If the score is >= this value, Sentinel recommends denying access. |
Calibration Warning
Setting a Deny threshold too low (e.g., 0.40) may produce deny advice for legitimate users who are traveling or using new devices. Start with conservative thresholds and monitor the dashboard before enforcing advice in your application.
T-OTP Integration
Sentinel allows you to globally enable or disable the Time-Based One-Time Password service. When enabled, you can offer 2FA via apps like Google Authenticator or Authy using Donutwork's native APIs.