[{"data":1,"prerenderedAt":589},["ShallowReactive",2],{"navigation_docs":3,"-guides-upgrade-and-roll-back":220,"-guides-upgrade-and-roll-back-surround":584},[4,25,60,91,190,205],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75,81,86],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"path":83,"stem":84,"icon":85},"Backup and restore","\u002Fguides\u002Fbackup-and-restore","3.guides\u002F4.backup-and-restore","i-lucide-database-backup",{"title":87,"path":88,"stem":89,"icon":90},"Upgrade and roll back","\u002Fguides\u002Fupgrade-and-roll-back","3.guides\u002F5.upgrade-and-roll-back","i-lucide-arrow-up-circle",{"title":92,"icon":6,"path":93,"stem":94,"children":95,"page":6},"API reference","\u002Fapi","4.api",[96,101,106,111,116,121,126,131,136,139,144,149,153,158,163,168,173,178,183,186],{"title":97,"path":98,"stem":99,"icon":100},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":102,"path":103,"stem":104,"icon":105},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":107,"path":108,"stem":109,"icon":110},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":112,"path":113,"stem":114,"icon":115},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":117,"path":118,"stem":119,"icon":120},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":122,"path":123,"stem":124,"icon":125},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":127,"path":128,"stem":129,"icon":130},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":132,"path":133,"stem":134,"icon":135},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":137,"stem":138,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":140,"path":141,"stem":142,"icon":143},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":145,"path":146,"stem":147,"icon":148},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":150,"path":151,"stem":152,"icon":120},"People and sessions","\u002Fapi\u002Fpeople","4.api\u002F12.people",{"title":154,"path":155,"stem":156,"icon":157},"Overview","\u002Fapi\u002Foverview","4.api\u002F13.overview","i-lucide-layout-dashboard",{"title":159,"path":160,"stem":161,"icon":162},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F14.webhooks","i-lucide-webhook",{"title":164,"path":165,"stem":166,"icon":167},"Cases","\u002Fapi\u002Fcases","4.api\u002F15.cases","i-lucide-folder-open",{"title":169,"path":170,"stem":171,"icon":172},"Reports","\u002Fapi\u002Freports","4.api\u002F16.reports","i-lucide-file-check",{"title":174,"path":175,"stem":176,"icon":177},"Organisation","\u002Fapi\u002Forganisation","4.api\u002F17.organisation","i-lucide-building-2",{"title":179,"path":180,"stem":181,"icon":182},"Setup","\u002Fapi\u002Fsetup","4.api\u002F18.setup","i-lucide-rocket",{"title":56,"path":184,"stem":185,"icon":59},"\u002Fapi\u002Faudit-log","4.api\u002F19.audit-log",{"title":80,"path":187,"stem":188,"icon":189,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F20.coming-soon","i-lucide-clock",{"title":191,"icon":6,"path":192,"stem":193,"children":194,"page":6},"Security and licensing","\u002Fsecurity","5.security",[195,200],{"title":196,"path":197,"stem":198,"icon":199},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":201,"path":202,"stem":203,"icon":204,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":206,"icon":6,"path":207,"stem":208,"children":209,"page":6},"Reference","\u002Freference","6.reference",[210,215],{"title":211,"path":212,"stem":213,"icon":214},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":216,"path":217,"stem":218,"icon":219},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":221,"title":87,"body":222,"description":577,"extension":578,"links":579,"meta":580,"navigation":581,"path":88,"seo":582,"stem":89,"__hash__":583},"docs\u002F3.guides\u002F5.upgrade-and-roll-back.md",{"type":223,"value":224,"toc":567},"minimark",[225,229,234,401,405,412,416,419,459,557,560,563],[226,227,228],"p",{},"Migrations are built into the binary and run when it starts, so an upgrade is: back up, swap the image, check. A rollback is the same in reverse, with one difference explained below.",[230,231,233],"h2",{"id":232},"upgrade","Upgrade",[235,236,238,243,250,292,296,301,305,308,388,391,395],"steps",{"level":237},"3",[239,240,242],"h3",{"id":241},"back-up","Back up",[226,244,245,246,249],{},"Take a backup you can restore. See ",[247,248,82],"a",{"href":83},".",[251,252,258],"pre",{"className":253,"code":254,"filename":255,"language":256,"meta":257,"style":257},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","docker exec sentinel \u002Fapp\u002Fsentinel-admin db backup -out \u002Fbackups\u002Fbefore-upgrade.dump\n","Terminal","bash","",[259,260,261],"code",{"__ignoreMap":257},[262,263,266,270,274,277,280,283,286,289],"span",{"class":264,"line":265},"line",1,[262,267,269],{"class":268},"sBMFI","docker",[262,271,273],{"class":272},"sfazB"," exec",[262,275,276],{"class":272}," sentinel",[262,278,279],{"class":272}," \u002Fapp\u002Fsentinel-admin",[262,281,282],{"class":272}," db",[262,284,285],{"class":272}," backup",[262,287,288],{"class":272}," -out",[262,290,291],{"class":272}," \u002Fbackups\u002Fbefore-upgrade.dump\n",[239,293,295],{"id":294},"read-the-release-notes","Read the release notes",[226,297,298,299,249],{},"Look for new environment variables and anything marked as a change to behaviour. Verify the image signature before you run it: see ",[247,300,21],{"href":22},[239,302,304],{"id":303},"replace-the-container","Replace the container",[226,306,307],{},"Start the new image with the same environment variables and the same database.",[251,309,311],{"className":253,"code":310,"filename":255,"language":256,"meta":257,"style":257},"docker pull \"$SENTINEL_IMAGE:$NEW_VERSION\"\ndocker stop sentinel && docker rm sentinel\ndocker run -d --name sentinel ... \"$SENTINEL_IMAGE:$NEW_VERSION\"\n",[259,312,313,337,359],{"__ignoreMap":257},[262,314,315,317,320,324,328,331,334],{"class":264,"line":265},[262,316,269],{"class":268},[262,318,319],{"class":272}," pull",[262,321,323],{"class":322},"sMK4o"," \"",[262,325,327],{"class":326},"sTEyZ","$SENTINEL_IMAGE",[262,329,330],{"class":272},":",[262,332,333],{"class":326},"$NEW_VERSION",[262,335,336],{"class":322},"\"\n",[262,338,340,342,345,347,350,353,356],{"class":264,"line":339},2,[262,341,269],{"class":268},[262,343,344],{"class":272}," stop",[262,346,276],{"class":272},[262,348,349],{"class":322}," &&",[262,351,352],{"class":268}," docker",[262,354,355],{"class":272}," rm",[262,357,358],{"class":272}," sentinel\n",[262,360,362,364,367,370,373,375,378,380,382,384,386],{"class":264,"line":361},3,[262,363,269],{"class":268},[262,365,366],{"class":272}," run",[262,368,369],{"class":272}," -d",[262,371,372],{"class":272}," --name",[262,374,276],{"class":272},[262,376,377],{"class":272}," ...",[262,379,323],{"class":322},[262,381,327],{"class":326},[262,383,330],{"class":272},[262,385,333],{"class":326},[262,387,336],{"class":322},[226,389,390],{},"It applies each pending migration and logs which ones it ran. If a migration fails, the container stops instead of serving a schema the code doesn't match.",[239,392,394],{"id":393},"check","Check",[226,396,397,400],{},[259,398,399],{},"GET \u002Fhealthz"," returns the new version. Sign in, open the alert queue, and send one test event. Rule activations and screening lists take up to 30 seconds to reach every instance.",[230,402,404],{"id":403},"with-several-instances","With several instances",[226,406,407,408,411],{},"Instances starting together take turns applying migrations, and the others wait. Replace them one at a time behind your load balancer. Zero-downtime upgrades aren't built yet, so do them in a quiet period and have the sending services retry. Events carry an ",[259,409,410],{},"idempotency_key",", so a retry never counts twice.",[230,413,415],{"id":414},"roll-back","Roll back",[226,417,418],{},"Going back to the previous image alone works only when the new version made no schema changes. The application only moves the schema forward and doesn't undo migrations. So:",[420,421,422,435],"table",{},[423,424,425],"thead",{},[426,427,428,432],"tr",{},[429,430,431],"th",{},"The upgrade",[429,433,434],{},"To go back",[436,437,438,447],"tbody",{},[426,439,440,444],{},[441,442,443],"td",{},"Ran no migrations",[441,445,446],{},"Start the previous image",[426,448,449,452],{},[441,450,451],{},"Ran migrations",[441,453,454,455,458],{},"Stop Sentinel, restore the backup you took before the upgrade into the database with ",[259,456,457],{},"-replace",", then start the previous image",[251,460,462],{"className":253,"code":461,"filename":255,"language":256,"meta":257,"style":257},"docker stop sentinel\ndocker run --rm --entrypoint \u002Fapp\u002Fsentinel-admin -v \u002Fbackups:\u002Fbackups -e SENTINEL_DATABASE_URL ... \\\n  \"$SENTINEL_IMAGE:$OLD_VERSION\" db restore -in \u002Fbackups\u002Fbefore-upgrade.dump -replace\ndocker run -d --name sentinel ... \"$SENTINEL_IMAGE:$OLD_VERSION\"\n",[259,463,464,472,503,532],{"__ignoreMap":257},[262,465,466,468,470],{"class":264,"line":265},[262,467,269],{"class":268},[262,469,344],{"class":272},[262,471,358],{"class":272},[262,473,474,476,478,481,484,486,489,492,495,498,500],{"class":264,"line":339},[262,475,269],{"class":268},[262,477,366],{"class":272},[262,479,480],{"class":272}," --rm",[262,482,483],{"class":272}," --entrypoint",[262,485,279],{"class":272},[262,487,488],{"class":272}," -v",[262,490,491],{"class":272}," \u002Fbackups:\u002Fbackups",[262,493,494],{"class":272}," -e",[262,496,497],{"class":272}," SENTINEL_DATABASE_URL",[262,499,377],{"class":272},[262,501,502],{"class":326}," \\\n",[262,504,505,508,510,512,515,518,520,523,526,529],{"class":264,"line":361},[262,506,507],{"class":322},"  \"",[262,509,327],{"class":326},[262,511,330],{"class":272},[262,513,514],{"class":326},"$OLD_VERSION",[262,516,517],{"class":322},"\"",[262,519,282],{"class":272},[262,521,522],{"class":272}," restore",[262,524,525],{"class":272}," -in",[262,527,528],{"class":272}," \u002Fbackups\u002Fbefore-upgrade.dump",[262,530,531],{"class":272}," -replace\n",[262,533,535,537,539,541,543,545,547,549,551,553,555],{"class":264,"line":534},4,[262,536,269],{"class":268},[262,538,366],{"class":272},[262,540,369],{"class":272},[262,542,372],{"class":272},[262,544,276],{"class":272},[262,546,377],{"class":272},[262,548,323],{"class":322},[262,550,327],{"class":326},[262,552,330],{"class":272},[262,554,514],{"class":326},[262,556,336],{"class":322},[226,558,559],{},"Restoring brings back the database as it was at the backup, so anything that happened since is gone. That includes events, alerts and filings. Resend events from your services. Alerts and filings made in that time have to be redone by hand, so decide quickly, and don't roll back for something a fix forward would solve.",[226,561,562],{},"The log shows which migrations an upgrade ran. If it ran none, you don't need the restore.",[564,565,566],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":257,"searchDepth":339,"depth":339,"links":568},[569,575,576],{"id":232,"depth":339,"text":233,"children":570},[571,572,573,574],{"id":241,"depth":361,"text":242},{"id":294,"depth":361,"text":295},{"id":303,"depth":361,"text":304},{"id":393,"depth":361,"text":394},{"id":403,"depth":339,"text":404},{"id":414,"depth":339,"text":415},"Move an install to a new version, and go back if it goes wrong.","md",null,{},{"icon":90},{"title":87,"description":577},"MZFrmqGZfgIhkXvLmlDLo_CvarWV4mOOIBN6pg05Xkg",[585,587],{"title":82,"path":83,"stem":84,"description":586,"icon":85,"children":-1},"Back up a Sentinel install, restore it, and prove the restored audit trail is intact.",{"title":97,"path":98,"stem":99,"description":588,"icon":100,"children":-1},"Base URL, API keys, sessions, roles, and how to set up a new install.",1792666436026]