[{"data":1,"prerenderedAt":858},["ShallowReactive",2],{"navigation_docs":3,"-concepts-entities-and-graph":183,"-concepts-entities-and-graph-surround":853},[4,25,60,81,153,168],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"icon":6,"path":83,"stem":84,"children":85,"page":6},"API reference","\u002Fapi","4.api",[86,91,96,101,106,111,116,121,126,129,134,139,144,149],{"title":87,"path":88,"stem":89,"icon":90},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":97,"path":98,"stem":99,"icon":100},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":102,"path":103,"stem":104,"icon":105},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":107,"path":108,"stem":109,"icon":110},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":112,"path":113,"stem":114,"icon":115},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":117,"path":118,"stem":119,"icon":120},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":122,"path":123,"stem":124,"icon":125},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":127,"stem":128,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":130,"path":131,"stem":132,"icon":133},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":135,"path":136,"stem":137,"icon":138},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"Overview","\u002Fapi\u002Foverview","4.api\u002F12.overview","i-lucide-layout-dashboard",{"title":145,"path":146,"stem":147,"icon":148,"badge":80},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F13.webhooks","i-lucide-webhook",{"title":80,"path":150,"stem":151,"icon":152,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F14.coming-soon","i-lucide-clock",{"title":154,"icon":6,"path":155,"stem":156,"children":157,"page":6},"Security and licensing","\u002Fsecurity","5.security",[158,163],{"title":159,"path":160,"stem":161,"icon":162},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":164,"path":165,"stem":166,"icon":167,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":169,"icon":6,"path":170,"stem":171,"children":172,"page":6},"Reference","\u002Freference","6.reference",[173,178],{"title":174,"path":175,"stem":176,"icon":177},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":179,"path":180,"stem":181,"icon":182},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":184,"title":51,"body":185,"description":846,"extension":847,"links":848,"meta":849,"navigation":850,"path":52,"seo":851,"stem":53,"__hash__":852},"docs\u002F2.concepts\u002F5.entities-and-graph.md",{"type":186,"value":187,"toc":838},"minimark",[188,192,196,212,313,316,320,327,387,409,417,421,428,440,448,452,459,835],[189,190,191],"p",{},"Sentinel models who your customers are, how they connect, and what they do. Decisions, alerts, cases and filings all hang off those three ideas.",[193,194,107],"h2",{"id":195},"entities",[189,197,198,199,203,204,211],{},"An ",[200,201,202],"strong",{},"entity"," is anything Sentinel keeps a profile for. You create or update one with ",[205,206,207],"a",{"href":108},[208,209,210],"code",{},"POST \u002Fv1\u002Fentities",". IDs are yours, so use the IDs your own systems already use.",[213,214,215,231],"table",{},[216,217,218],"thead",{},[219,220,221,225,228],"tr",{},[222,223,224],"th",{},"Kind",[222,226,227],{},"Represents",[222,229,230],{},"Typical attributes",[232,233,234,248,261,274,287,300],"tbody",{},[219,235,236,242,245],{},[237,238,239],"td",{},[208,240,241],{},"customer",[237,243,244],{},"A person or business you serve",[237,246,247],{},"Name, date of birth, national ID, KYC result, risk tier",[219,249,250,255,258],{},[237,251,252],{},[208,253,254],{},"account",[237,256,257],{},"A bank or ledger account",[237,259,260],{},"Currency, opened date, product",[219,262,263,268,271],{},[237,264,265],{},[208,266,267],{},"wallet",[237,269,270],{},"A mobile money or e-money wallet",[237,272,273],{},"Operator, phone number, tier, opened date",[219,275,276,281,284],{},[237,277,278],{},[208,279,280],{},"device",[237,282,283],{},"A phone or browser seen on your platform",[237,285,286],{},"Fingerprint, OS, first seen",[219,288,289,294,297],{},[237,290,291],{},[208,292,293],{},"agent",[237,295,296],{},"A cash-in \u002F cash-out agent or merchant",[237,298,299],{},"Location, operator, till number",[219,301,302,307,310],{},[237,303,304],{},[208,305,306],{},"counterparty",[237,308,309],{},"Someone on the other side who isn't your customer",[237,311,312],{},"Name, institution, country",[189,314,315],{},"Attributes are free-form JSON. Send what you have now and add fields later without a migration.",[193,317,319],{"id":318},"links","Links",[189,321,322,323,326],{},"A link records that two entities are related, with the first and last time it was seen. Every event with a ",[208,324,325],{},"source.entity_id"," adds links, and replaying an event changes nothing:",[213,328,329,345],{},[216,330,331],{},[219,332,333,336,339,342],{},[222,334,335],{},"Relation",[222,337,338],{},"From",[222,340,341],{},"To",[222,343,344],{},"Recorded when",[232,346,347,369],{},[219,348,349,354,357,360],{},[237,350,351],{},[208,352,353],{},"paid",[237,355,356],{},"The sender",[237,358,359],{},"The receiver",[237,361,362,363,365,366],{},"The event names both ",[208,364,325],{}," and ",[208,367,368],{},"destination.entity_id",[219,370,371,376,378,381],{},[237,372,373],{},[208,374,375],{},"uses_device",[237,377,356],{},[237,379,380],{},"The device",[237,382,383,384],{},"The event has a ",[208,385,386],{},"device.id",[189,388,389,390,396,397,400,401,404,405,408],{},"Reading links back with ",[205,391,393],{"href":392},"\u002Fapi\u002Fentities#links",[208,394,395],{},"GET \u002Fv1\u002Fentities\u002F{id}\u002Flinks"," also follows them one step: who paid this entity (",[208,398,399],{},"paid_by","), who used a device (",[208,402,403],{},"device_user","), and anyone else who used one of its devices (",[208,406,407],{},"shares_device","). Each linked entity comes with its open alert, if it has one.",[189,410,411,412,416],{},"If an event names someone you never registered, Sentinel adds a placeholder entity so the link has two ends. A placeholder's kind is a guess, so it's never shown; register the entity with ",[205,413,414],{"href":108},[208,415,210],{}," and its real kind and attributes take over.",[193,418,420],{"id":419},"the-entity-graph","The entity graph",[189,422,423,424,427],{},"Together, the links form the ",[200,425,426],{},"entity graph",". Patterns often show in connections rather than single transactions. One wallet receiving from 23 senders looks odd. The same wallet sharing a phone with four others and cashing out at an agent who serves all five looks much worse.",[189,429,430,431,434,435,439],{},"The alert panel's ",[200,432,433],{},"Linked entities"," list is built from the graph today, and the ",[205,436,438],{"href":437},"\u002Fconcepts\u002Frules#the-built-in-pack","built-in rules"," count senders and receivers.",[441,442,443,444,447],"note",{},"Not built yet: the ",[200,445,446],{},"Network graph"," screen, links for phone numbers and national IDs, ownership links (a customer and their wallets), and rules that count shared devices.",[193,449,451],{"id":450},"core-tables","Core tables",[189,453,454,455,458],{},"Every table except the screening lists carries an ",[208,456,457],{},"org_id",", so one install can hold several organisations with complete separation.",[213,460,461,474],{},[216,462,463],{},[219,464,465,468,471],{},[222,466,467],{},"Table",[222,469,470],{},"Key columns",[222,472,473],{},"Notes",[232,475,476,506,537,588,615,649,666,686,721,749,774,810],{},[219,477,478,482,503],{},[237,479,480],{},[208,481,195],{},[237,483,484,486,487,486,490,486,493,496,497,486,500],{},[208,485,457],{},", ",[208,488,489],{},"id",[208,491,492],{},"kind",[208,494,495],{},"attributes"," (jsonb), ",[208,498,499],{},"created_at",[208,501,502],{},"updated_at",[237,504,505],{},"Your IDs",[219,507,508,513,530],{},[237,509,510],{},[208,511,512],{},"entity_links",[237,514,515,486,518,486,521,486,524,486,527],{},[208,516,517],{},"src_id",[208,519,520],{},"dst_id",[208,522,523],{},"relation",[208,525,526],{},"first_seen",[208,528,529],{},"last_seen",[237,531,532,365,534,536],{},[208,533,353],{},[208,535,375],{},", filled from events",[219,538,539,544,577],{},[237,540,541],{},[208,542,543],{},"events",[237,545,546,486,548,551,552,486,555,486,558,486,561,486,564,486,567,486,570,486,573,576],{},[208,547,489],{},[208,549,550],{},"idempotency_key"," (unique), ",[208,553,554],{},"type",[208,556,557],{},"occurred_at",[208,559,560],{},"amount_value",[208,562,563],{},"currency",[208,565,566],{},"rail",[208,568,569],{},"source_id",[208,571,572],{},"destination_id",[208,574,575],{},"payload"," (jsonb)",[237,578,579,365,581,583,584,365,586],{},[208,580,569],{},[208,582,572],{}," are the event's ",[208,585,325],{},[208,587,368],{},[219,589,590,595,612],{},[237,591,592],{},[208,593,594],{},"decisions",[237,596,597,551,600,486,603,486,606,496,609,576],{},[208,598,599],{},"event_id",[208,601,602],{},"decision",[208,604,605],{},"risk_score",[208,607,608],{},"reasons",[208,610,611],{},"features",[237,613,614],{},"One decision per event",[219,616,617,622,646],{},[237,618,619],{},[208,620,621],{},"alerts",[237,623,624,486,627,486,629,486,631,486,634,486,637,486,640,486,643],{},[208,625,626],{},"decision_id",[208,628,599],{},[208,630,569],{},[208,632,633],{},"status",[208,635,636],{},"priority",[208,638,639],{},"occurrences",[208,641,642],{},"assigned_to",[208,644,645],{},"disposition",[237,647,648],{},"One open alert per source",[219,650,651,656,663],{},[237,652,653],{},[208,654,655],{},"alert_decisions",[237,657,658,486,661],{},[208,659,660],{},"alert_id",[208,662,626],{},[237,664,665],{},"Every decision on an alert",[219,667,668,673,683],{},[237,669,670],{},[208,671,672],{},"alert_notes",[237,674,675,486,677,486,680],{},[208,676,660],{},[208,678,679],{},"author",[208,681,682],{},"body",[237,684,685],{},"Notes on alerts",[219,687,688,693,718],{},[237,689,690],{},[208,691,692],{},"rules",[237,694,695,486,698,486,701,486,704,486,707,486,710,486,712,486,715],{},[208,696,697],{},"rule_key",[208,699,700],{},"version",[208,702,703],{},"expr",[208,705,706],{},"weight",[208,708,709],{},"subject",[208,711,633],{},[208,713,714],{},"created_by",[208,716,717],{},"approved_by",[237,719,720],{},"Every version is kept",[219,722,723,731,746],{},[237,724,725,486,728],{},[208,726,727],{},"screening_lists",[208,729,730],{},"screening_entries",[237,732,733,486,735,486,737,486,740,486,743],{},[208,734,208],{},[208,736,700],{},[208,738,739],{},"ref",[208,741,742],{},"name",[208,744,745],{},"category",[237,747,748],{},"Shared by the whole install",[219,750,751,756,771],{},[237,752,753],{},[208,754,755],{},"screenings",[237,757,758,486,761,486,763,486,765,486,768],{},[208,759,760],{},"reference",[208,762,633],{},[208,764,709],{},[208,766,767],{},"matches",[208,769,770],{},"lists",[237,772,773],{},"Each result as it was returned",[219,775,776,781,807],{},[237,777,778],{},[208,779,780],{},"audit_log",[237,782,783,486,786,486,789,486,792,486,795,486,798,486,801,486,804],{},[208,784,785],{},"seq",[208,787,788],{},"actor",[208,790,791],{},"action",[208,793,794],{},"target_type",[208,796,797],{},"target_id",[208,799,800],{},"data",[208,802,803],{},"prev_hash",[208,805,806],{},"hash",[237,808,809],{},"Append-only",[219,811,812,817,832],{},[237,813,814],{},[208,815,816],{},"api_keys",[237,818,819,486,821,551,824,486,827,486,829],{},[208,820,742],{},[208,822,823],{},"key_hash",[208,825,826],{},"key_prefix",[208,828,714],{},[208,830,831],{},"revoked_at",[237,833,834],{},"Hashes only",[189,836,837],{},"Cases, reports and users are part of the product design. Their tables don't exist yet.",{"title":839,"searchDepth":840,"depth":840,"links":841},"",2,[842,843,844,845],{"id":195,"depth":840,"text":107},{"id":318,"depth":840,"text":319},{"id":419,"depth":840,"text":420},{"id":450,"depth":840,"text":451},"The people, accounts, devices and agents Sentinel keeps profiles for, and how they connect.","md",null,{},{"icon":54},{"title":51,"description":846},"yQLiVq0atQwIbOEOBUorqNBzQVk6dsDUIomItm4zHpk",[854,856],{"title":46,"path":47,"stem":48,"description":855,"icon":49,"children":-1},"From a decision to a report filed with your FIU.",{"title":56,"path":57,"stem":58,"description":857,"icon":59,"children":-1},"The append-only, hash-chained record of the actions people and keys take in Sentinel.",1792169658428]