EveryHost: Magento Dedicated Hosting UK
    Sentinel Suite: Shield Edition

    Defense in Depth for
    Magento 2 Stores

    Sentinel isn't just a firewall. It's an in-house, AI-assisted framework that watches every layer of your stack, from PHP-FPM processes to Nginx request logs.

    Get Protected

    🔰 Overview

    The Sentinel Suite is EveryHost’ in-house AI-powered security and performance framework, built specifically for Magento 2 hosting environments. Unlike generic one-size-fits-all security suites, Sentinel operates at a stack-aware level, understanding Magento’s architecture, log patterns, cron structure, search queries, and Redis/OpenSearch behaviour.

    It runs as a lightweight agent on each server, feeding JSON reports and metrics back to WHMCS dashboards, and coordinating defences through Sentinel Shield, the system’s central intelligence layer.

    🧱 Sentinel Shield (Core Defence Layer)

    Status: Active replacement for sentinel-abuse-guard.sh

    💡 Function

    Sentinel Shield is the central nervous system of the entire Sentinel stack. It continuously monitors server metrics, AI log signals, Redis activity, and PHP process data, then acts dynamically to prevent overload or abuse in real-time. Its rules filter exactly the attack classes behind recent bulletins like the APSB26-73 webhooks RCE (CVE-2026-48358): mitigation while you patch, at the web layer where these attacks arrive.

    A WAF works at the web layer, so it is worth being clear about what it cannot reach. Kernel-level local privilege-escalation flaws such as RefluXFS (CVE-2026-64600) are exploited from an account already on the machine, below the layer any WAF inspects. No WAF stops those, and any host claiming otherwise is overselling. That class of risk is answered by architecture instead: on Magento dedicated hosting UK there are no neighbouring tenants to launch the attack from, which is why we run single-tenant hardware rather than packing stores onto a shared kernel.

    The same honesty applies to application-layer Magento flaws. When Adobe disclosed CVE-2026-71362, the APSB26-92 account takeover, exploit attempts arrived as ordinary HTTP requests, which is exactly the traffic a WAF inspects and can block. But blocking attempts is mitigation, not a fix: the flaw sits in Magento's own session and authorization code, and only Adobe's patch removes it. Sentinel buys you a safe window to patch properly. It does not make an unpatched store safe, and we will not tell you it does.

    🔧 Features

    • Real-time telemetry feed from loadwatch, redis-watch, and log-scan.
    • Adaptive response engine with internal scoring model.
    • Unified JSON status (shield-state.json) for WHMCS / Grafana.
    • AI-assisted decision layer (GPT-4) to differentiate spikes from bots.
    • Self-healing routines for Redis locks and PHP workers.

    Response Levels

    Level 1Log and monitor
    Level 2Throttle connections / kill processes
    Level 3CSF block offending IP or /24 subnet
    Level 4Lockdown Mode (halts cron, rate-limits PHP)

    Evolution: From Abuse Guard to Shield

    CapabilityLegacyShield
    Process Scanning✅✅ Real-time
    AI Logic❌✅ GPT-based
    Auto-healing❌✅ Built-in
    Inter-module SyncIsolated✅ Full Sync

    ⚙️ Core Monitoring Modules

    1. sentinel-log-scan.sh

    AI-powered analysis of Magento, Apache, PHP, Redis, and OpenSearch logs. Uses GPT to detect malicious patterns (SQLi, exploits).

    Outputs: logscan.json

    2. sentinel-cronwatch.sh

    Tracks Magento cron processes. Detects if cron exceeds runtime (3600s), auto-unlocks stuck jobs, and reports to WHMCS.

    Outputs: cronwatch.json

    3. sentinel-admin-audit.sh

    Monitors Magento admin users. Detects new user creation, role modification, or password resets. Links to 2fa-watch.

    Outputs: admin-audit.json

    4. sentinel-2fa-watch.sh

    Protects backend from brute-force. Scans admin logs for disabled 2FA accounts or failed logins. Sends instant alerts.

    5. sentinel-session-leak.sh

    Scans var/session for abnormal growth. Detects bots holding persistent sessions. Correlates spikes with IPs.

    Outputs: session-leak.json

    6. sentinel-hackwatch.sh

    File integrity checks. Detects code injection, webshells, or core modifications using regex and hash comparison.

    Outputs: hackwatch.json

    7. sentinel-geo-report.sh

    Parses logs with MaxMind GeoIP2. Identifies high-risk countries and ASNs. Feeds Shield with origin data for blocking.

    8. sentinel-searchwatch.sh

    Detects abusive search queries targeting OpenSearch. Blocks excessive query frequency and scraping bots automatically.

    Outputs: searchwatch.json

    9. sentinel-ipflood.sh

    Analyses recent access logs for flooding IPs. Uses improved timestamp parsing. Auto-blocks abusive IPs/CIDRs.

    Outputs: ipflood.json

    10. sentinel-loadwatch.sh

    Continuously tracks load, CPU, RAM, I/O. Feeds metrics to Shield. Integrates with Prometheus/Grafana.

    11. sentinel-redis-watch.sh

    Monitors Redis for excessive memory or stuck BGSAVE. Kills heavy background saves. Adjusts persistence dynamically.

    12. sentinel-config-audit.sh

    Audits CSF, PHP INI, Redis, MySQL configs using GPT. Generates scored reports and improvement suggestions.

    📈 Data, Integration, and Dashboards

    🔒 Agent + Token Model

    Every Sentinel module exposes a token-secured JSON API. Data is stored in /public_html/sentinel-agent/*.json and pulled securely by WHMCS modules.

    🖥️ WHMCS Integration

    Fully modular dashboard including IP Flood Monitor, Cron Watch, Geo Report, Search Abuse, Log Watch, and Shield Status. Supports auto-notifications.

    📊 Grafana / Prometheus Compatibility

    Sentinel exports JSON metrics compatible with Prometheus exporters. Visualize Shield state, load, and Redis usage in real-time.

    Frequently Asked Questions

    Sentinel Suite is EveryHost's proprietary AI-powered security and performance framework built specifically for Magento 2 hosting. It monitors your entire stack from PHP-FPM processes to Nginx logs.

    Sentinel Shield acts as an intelligent WAF layer with Magento-specific rules. It goes beyond traditional WAFs by understanding Magento's architecture and can detect attacks that generic firewalls miss.

    Lockdown Mode is Sentinel's emergency response level that activates during severe attacks. It halts non-essential cron jobs, rate-limits PHP workers, and blocks offending IPs or entire /24 subnets via CSF.

    SearchWatch detects search abuse patterns, IPFlood identifies flooding IPs, and SessionLeak tracks abnormal session growth. Offending bots are automatically blocked at the firewall level.

    Yes! Sentinel integrates with WHMCS dashboards showing real-time status of all modules. It also exports JSON metrics compatible with Grafana and Prometheus for advanced monitoring.

    No. Sentinel Suite is included with every EveryHost Magento hosting plan at no additional cost. It's our proprietary technology built in-house.

    Sentinel contributes to several PCI DSS requirements including file integrity monitoring, intrusion detection, log analysis, and firewall management. Combined with our hardened server configuration and encrypted connections, it significantly reduces the compliance burden for Magento merchants.

    Sentinel HackWatch runs continuous file integrity checks and can detect code injection, webshells, or core file modifications within minutes. When malware is detected, our engineering team is alerted immediately and begins remediation, typically within 30 minutes during business hours.

    Sentinel uses an AI-assisted decision layer to differentiate genuine threats from legitimate traffic spikes or unusual but safe behaviour. Its internal scoring model considers multiple signals before escalating, which minimises false positives. Any automated blocks can be reviewed and whitelisted by our team.

    Yes. While Sentinel is optimised for Magento 2, its core monitoring modules, including IPFlood, HackWatch, LoadWatch, and Redis Watch, work with Magento 1 installations. Log scanning patterns are adjusted to match the Magento 1 log format.

    Absolutely. Our engineers can create custom Sentinel rules tailored to your store's specific traffic patterns, geographic requirements, and integration needs. Custom rules are particularly useful for stores with known API traffic, webhook endpoints, or region-specific access requirements.

    Sentinel sends real-time alerts for critical events including malware detection, brute-force attempts, abnormal load spikes, stuck cron jobs, Redis memory issues, and admin account changes. Alerts are delivered to our engineering team and can also be forwarded to your team via email or webhook.

    Unmatched Intelligence

    Sentinel Suite gives EveryHost and its clients Magento-specific intelligence, real-time AI detection, and unified dashboards, with zero license cost.

    Get Sentinel Now