How to use SentinelOps

SentinelOps is a human-gated agentic DevOps platform from RBM Research Centre. It helps your team respond to support tickets and production errors with AI-prepared code fixes. An agent analyzes the issue, proposes changes on a separate branch, and waits for a human to review before opening a draft pull request.

Nothing is merged automatically. You always decide whether a fix should become a pull request.

The Overview page shows live counts for:

• Open issues — tickets or errors still being analyzed or waiting for a decision
• Awaiting approval — fixes ready for your review
• PRs created — approved fixes that became draft pull requests
• Failed runs — agent runs that could not complete

Recent agent runs lists the latest fix attempts. Click any row to open it in Tickets & fixes.

Projects

Open Settings → Projects to map each product or app to one GitHub repository.

1. Fill in the project name and slug. The slug identifies this project when tickets or logs arrive.
2. Enter the GitHub owner and repository name (for example acme and customer-portal — not a full URL).
3. Set the default branch, usually main.
4. Click Save project for a new project, or Edit on an existing row to update it.

Integration credentials

Still on Settings, choose a project from the dropdown, then configure each integration:

• GitHub — token used to read the repo, create fix branches, and open draft PRs after approval
• GitHub Issues — signed intake for newly opened issues labeled or typed as defects and requirements
• Jira Cloud — signed intake for newly created Bug, Defect, Story, Feature, or Requirement issues
• Cursor — API key for the cloud agent that writes the fix
• Slack — optional approval messages with Approve / Reject buttons
• Microsoft Teams — optional notifications that link back here for the final decision
• Log webhook — universal secret for GCP, Grafana, Elasticsearch, Datadog, or any custom forwarder
• Project management webhook — timestamped signed intake for defects and requirements from other tools
• Vercel logs — dedicated Vercel Log Drain secret
• AWS CloudWatch — dedicated CloudWatch/Lambda forwarder secret

Saved secrets are encrypted and are never shown again in the form. Leave a secret field blank when updating other settings if you do not want to change it.

First create a project under Settings. In Integration credentials, select that project before configuring each service. Turn on Enable integration and save each card after entering its values.

GitHub

GitHub access is required to read repository files, create an agent branch, compare changes, and open a draft pull request.

1. Open GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens.
2. Create a token and restrict Repository access to the repository configured for this SentinelOps project.
3. Grant Contents: Read and write, Pull requests: Read and write, and Metadata: Read.
4. Copy the github_pat_… value immediately.
5. In SentinelOps Settings → Integration credentials → GitHub, paste it into Fine-grained access token, enable the integration, and save.

Create the token at GitHub fine-grained personal access tokens.

GitHub Issues intake

1. Generate a strong random webhook secret.
2. In SentinelOps Settings → GitHub Issues, enter defect labels (bug,defect), requirement labels (enhancement,feature,requirement), and the secret; then enable and save.
3. In the configured GitHub repository, open Settings → Webhooks → Add webhook.
4. Set the Payload URL to https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/github-issues/YOUR_PROJECT_SLUG and Content type to application/json.
5. Enter the same secret, select Let me select individual events, enable Issues, and save.

Jira Cloud intake

1. Generate a strong random webhook secret.
2. In SentinelOps Settings → Jira Cloud, enter the accepted defect issue types (Bug,Defect), requirement issue types (Story,Feature,Requirement), and the secret; then enable and save.
3. In Jira Cloud, open Settings → System → WebHooks and create a webhook.
4. Set the URL to https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/jira/YOUR_PROJECT_SLUG.
5. Enter the same secret, select the Issue created event, optionally restrict projects with JQL, and save.

Other project-management tools

1. Generate a strong random secret and save it in the Project management webhook card.
2. Configure your tool or an automation service to POST the normalized JSON documented below to https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/project-issues.
3. Send x-project-slug and the current Unix timestamp in x-webhook-timestamp.
4. Sign timestamp.rawBody with HMAC-SHA256 and send sha256=<hex digest> in x-webhook-signature.
5. Enable and save the integration, then send a test defect or requirement.

Cursor

Cursor Cloud Agents inspect the repository and prepare the proposed fix on an isolated branch.

1. Open Cursor Dashboard → Integrations and create an API key. A team may instead use a service-account key.
2. Copy the cursor_… API key.
3. In SentinelOps Settings → Integration credentials → Cursor, paste the API key.
4. Set Model to auto unless your Cursor account requires a specific available model.
5. Enable the integration and save.

Manage keys in Cursor Dashboard → Integrations. The key owner must be able to access the configured GitHub repository.

Slack

1. Open Slack API Apps, create an app From scratch, and select your workspace.
2. Open OAuth & Permissions, add the chat:write Bot Token Scope, then install the app to the workspace.
3. Copy the Bot User OAuth Token beginning xoxb-….
4. Under Basic Information → App Credentials, copy the Signing Secret.
5. Enable Interactivity & Shortcuts and set its Request URL to https://sentinelops.rbmresearchcentre.com/api/v1/slack/actions.
6. Copy the destination Channel ID from the channel details and each approver Member ID from their Slack profile.
7. Invite the bot to the destination channel.
8. In the SentinelOps Slack card, enter the channel ID, comma-separated approver IDs, bot token, and signing secret; then enable and save.

Start at Slack API Apps. Only listed approver IDs can use the Approve and Reject buttons.

Microsoft Teams

1. In Microsoft Teams, open the target channel and select Workflows.
2. Choose the workflow template that posts to a channel when a webhook request is received.
3. Select the Team and Channel, finish creating the workflow, and copy its HTTP POST URL.
4. In SentinelOps Settings → Integration credentials → Microsoft Teams, paste it into Workflow webhook URL.
5. Enable the integration and save.

Vercel logs webhook

1. Generate a strong random secret and save it in the SentinelOps Vercel logs card.
2. In Vercel, create a Log Drain for your project.
3. Use https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/vercel-logs as the endpoint.
4. Add x-project-slug with the slug shown in SentinelOps Settings.
5. Configure the forwarder to send x-vercel-signature as the HMAC-SHA1 hex digest of the exact raw request body.
6. Enable and save the integration.

See Webhooks below for the expected payload, headers, and signature example.

AWS CloudWatch

1. Generate a strong random secret and save it in the SentinelOps AWS CloudWatch card.
2. In AWS CloudWatch Logs, create a subscription filter for the required log group.
3. Send matching events to a Lambda function or another HTTP forwarder.
4. POST the payload to https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/aws-cloudwatch.
5. Send x-project-slug and an x-webhook-signature containing the HMAC-SHA256 hex digest of the exact raw body.
6. Enable and save the integration.

The Lambda signing example is available in the AWS CloudWatch webhook documentation.

Universal logs webhook

Use this integration for GCP, Grafana, Elasticsearch, Datadog, or any custom service capable of forwarding JSON.

1. Generate a strong random secret and save it in the SentinelOps Log webhook card.
2. Configure the log source to POST JSON to https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/runtime-logs.
3. Send x-project-slug with the project slug.
4. Sign the exact raw body with the saved secret and send the HMAC-SHA256 hex digest as x-webhook-signature.
5. Enable and save the integration, then send a test error event.
6. Check Dashboard → Runtime errors to confirm that SentinelOps accepted the event.

External systems send issues into SentinelOps through webhook endpoints. Use the project slug from Settings to route events to the correct repository.

Support ticket webhook

Submit user-reported issues from a help desk, in-app form, or any backend service. No authentication header is required. The endpoint supports browser CORS preflight.

Request body

POST https://your-app.example.com/api/v1/support/ticket
Content-Type: application/json

{
  "projectSlug": "customer-portal",
  "title": "Checkout API returns HTTP 500",
  "description": "Customers receive an internal server error when submitting checkout.",
  "url": "https://help.example.com/tickets/1001",
  "metadata": {
    "environment": "staging",
    "priority": "high"
  }
}

Responses

• 202 Accepted — ticket saved and analysis queued. Returns ticketId, fixAttemptId, and status.
• 400 — invalid or missing fields.
• 404 — unknown or inactive projectSlug.
• 503 — ticket saved but analysis could not be queued. Check the detail field in the response.

Track submitted tickets under Tickets & fixes.

Jira defects and requirements

Jira sends its native jira:issue_created payload. The issue ID provides idempotency, so retries do not create another ticket or agent run.

POST https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/jira/YOUR_PROJECT_SLUG
Content-Type: application/json
X-Hub-Signature: sha256=<hmac-sha256-of-raw-body>

Accepted issue types by default:
Defects: Bug, Defect
Requirements: Story, Feature, Requirement

GitHub Issues defects and requirements

Subscribe the repository webhook only to Issues. SentinelOps verifies the repository name and GitHub signature before reading the issue.

POST https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/github-issues/YOUR_PROJECT_SLUG
Content-Type: application/json
X-GitHub-Event: issues
X-GitHub-Delivery: <delivery-id>
X-Hub-Signature-256: sha256=<hmac-sha256-of-raw-body>

Accepted labels or issue types by default:
Defects: bug, defect
Requirements: enhancement, feature, requirement

Generic project-management issue webhook

Use this normalized endpoint from Azure DevOps, Linear, Trello, or any automation platform. The timestamp must be within five minutes.

POST https://sentinelops.rbmresearchcentre.com/api/v1/webhooks/project-issues
Content-Type: application/json
x-project-slug: customer-portal
x-webhook-timestamp: <unix-seconds>
x-webhook-signature: sha256=<hmac-sha256-of-timestamp.raw-body>

{
  "externalId": "PM-1001",
  "externalKey": "PM-1001",
  "type": "defect",
  "title": "Checkout returns HTTP 500",
  "description": "Checkout fails after payment authorization for all customers.",
  "url": "https://pm.example.com/issues/PM-1001",
  "reporterName": "Operations",
  "metadata": { "priority": "high" }
}

Timestamped signing example

const crypto = require("crypto");
const body = JSON.stringify(issue);
const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = "sha256=" + crypto
  .createHmac("sha256", process.env.SENTINEL_WEBHOOK_SECRET)
  .update(timestamp + "." + body)
  .digest("hex");

Universal runtime logs webhook

Use one endpoint for logs from Google Cloud, Grafana, Elasticsearch, Datadog, or any service that can POST JSON. Enable Log webhook in Settings and point your forwarder here.

1. Open Settings → Integration credentials → Log webhook.
2. Save a strong webhook secret.
3. Configure your log source to POST JSON to the URL below.
4. Send header x-project-slug with your project slug.
5. Sign the raw body with HMAC-SHA256 in header x-webhook-signature.

SentinelOps auto-detects common payload shapes. You can send a single error, an array, or wrapped batches in logs, events, or records.

Minimal error payload

POST https://your-app.example.com/api/v1/webhooks/runtime-logs
Content-Type: application/json
x-project-slug: customer-portal
x-webhook-signature: <hmac-sha256-hex-of-raw-body>

{
  "level": "error",
  "message": "Error: database connection failed",
  "stack": "Error: database connection failed\n    at handler (/app/index.js:42:11)",
  "path": "/api/checkout",
  "statusCode": 500,
  "timestamp": "2026-07-18T00:00:00.000Z"
}

Google Cloud Logging

{
  "entries": [
    {
      "severity": "ERROR",
      "timestamp": "2026-07-18T00:00:00.000Z",
      "textPayload": "Error: database connection failed",
      "resource": {
        "type": "cloud_run_revision",
        "labels": { "service_name": "checkout-api" }
      }
    }
  ]
}

Grafana alert notification

{
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": { "service": "checkout-api", "path": "/api/checkout" },
      "annotations": {
        "summary": "Checkout API error rate high",
        "description": "Error: database connection failed"
      },
      "startsAt": "2026-07-18T00:00:00.000Z"
    }
  ]
}

Elasticsearch search result

{
  "hits": {
    "hits": [
      {
        "_source": {
          "@timestamp": "2026-07-18T00:00:00.000Z",
          "level": "error",
          "message": "Error: database connection failed",
          "stack_trace": "…",
          "service": "checkout-api"
        }
      }
    ]
  }
}

Vercel runtime logs webhook

Send production runtime errors from Vercel. Each new error group triggers an agent run; repeat occurrences of the same error are deduplicated automatically.

1. Open Settings → Integration credentials and select your project.
2. Enable Vercel logs and save a strong webhook secret.
3. In Vercel, create a Log Drain pointing to the URL below.
4. Add a custom header x-project-slug set to your project slug.
5. Configure Vercel to sign requests with the same webhook secret.

POST https://your-app.example.com/api/v1/webhooks/vercel-logs
Content-Type: application/json
x-project-slug: customer-portal
x-vercel-signature: <hmac-sha1-hex-of-raw-body>

{
  "level": "error",
  "message": "Error: database connection failed",
  "stack": "Error: database connection failed\n    at checkout (/app/api/checkout.js:42:11)",
  "path": "/api/checkout",
  "statusCode": 500,
  "timestamp": "2026-07-18T00:00:00.000Z"
}

SentinelOps treats a log entry as a failure when any of these apply: HTTP status ≥ 500, level is error or fatal, or the message looks like an error. Non-error logs are ignored.

AWS CloudWatch logs webhook

Forward production errors from AWS Lambda, ECS, or other CloudWatch log groups. The usual pattern is a CloudWatch Logs subscription filter → Lambda function → HTTP POST to SentinelOps.

1. Open Settings → Integration credentials and select your project.
2. Enable AWS CloudWatch and save a strong webhook secret.
3. Create a CloudWatch Logs subscription filter on your log group.
4. Use a Lambda (or similar forwarder) to POST the subscription payload to the URL below.
5. Send header x-project-slug with your project slug.
6. Sign the raw body with HMAC-SHA256 using the same secret in header x-webhook-signature.

You can POST the native CloudWatch Logs subscription format (with logEvents) or a single normalized error object. JSON messages inside each log line are parsed automatically.

POST https://your-app.example.com/api/v1/webhooks/aws-cloudwatch
Content-Type: application/json
x-project-slug: customer-portal
x-webhook-signature: <hmac-sha256-hex-of-raw-body>

{
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/checkout-api",
  "logStream": "2026/07/20/[$LATEST]abc123",
  "logEvents": [
    {
      "id": "event-1",
      "timestamp": 1721451600000,
      "message": "ERROR Error: database connection failed\n    at handler (/var/task/index.js:42:11)"
    }
  ]
}

Lambda signing example

const crypto = require("crypto");

exports.handler = async (event) => {
  const body = JSON.stringify(event);
  const signature = crypto
    .createHmac("sha256", process.env.SENTINEL_WEBHOOK_SECRET)
    .update(body)
    .digest("hex");

  await fetch("https://your-app.example.com/api/v1/webhooks/aws-cloudwatch", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-project-slug": "customer-portal",
      "x-webhook-signature": signature,
    },
    body,
  });
};

Successful response

{
  "received": 1,
  "accepted": 1,
  "deduplicated": 0,
  "failed": 0,
  "ignored": 0
}

• accepted — new error group; agent analysis queued
• deduplicated — same error seen again; occurrence count updated, no new agent run
• failed — error saved but analysis could not be queued
• ignored — payload did not contain a qualifying error

View ingested errors on Runtime errors.

Issues arrive through the webhooks above. After submission, they appear automatically in the dashboard:

• Tickets & fixes — support tickets submitted via the ticket webhook
• Runtime errors — log events from Vercel, AWS CloudWatch, and other connected sources

See the Webhooks section for endpoint URLs, headers, and example payloads.

When analysis finishes, open the fix from either:

• Approvals — queue of items waiting for a decision (use Pending / All tabs)
• Tickets & fixes — browse by support ticket and inspect one fix in detail

Each fix shows:

• Issue — original ticket text or error details
• Root cause — what the agent identified
• Proposed fix / change summary — plain-language explanation of the intended change
• Code changes — file-by-file diff with additions in green and removals in red

Expand individual files in the diff viewer, or use Expand all / Collapse all to scan every changed file quickly.

When a fix is Awaiting approval, use the action buttons on the Approvals or Tickets page, or respond from Slack if your project has Slack configured.

Approve & open PR

Creates a draftpull request on GitHub with the agent's branch. You still review and merge the PR normally in GitHub — SentinelOps never merges for you.

Reject

Discards the proposed fix and deletes the agent branch (only branches named agent/… are removed). The issue stays marked as rejected so you have a record of the decision.

• Fixes are always prepared on a separate branch, never on main.
• Pull requests are drafts until your team finishes review in GitHub.
• Approving only opens the PR — it does not deploy or merge code.
• Rejecting removes the agent branch but keeps the issue history here.
• After a PR is created, use the link on the fix card to open it in GitHub for code review, CI, and merge.