We Write the Rules. You Run the Scans.
Choose from 500+ production-ready rules, or let us build rules tailored to your organization. Either way, you skip the hard part. The SentriFlow engine is free. The expertise is what you're buying.
12 vendors • Cloud licensing • Offline support
Built for Enterprise Network Validation
Three core differentiators that set SentriFlow apart from traditional validation tools
Fault-Tolerant Parsing
Gracefully handles malformed configurations, incomplete files, and vendor-specific quirks without failing. Extract maximum value from imperfect data.
Multi-Vendor Support
Native support for Cisco, Juniper, Palo Alto, Fortinet, Arista, Aruba, and 6 more vendors. One tool to validate your entire network estate.
Cloud-Native Licensing
Seamless cloud activation with 24-hour offline grace period. Download offline packs for air-gapped environments when needed.
The Engine is Free Forever
Everything you need to scan and validate configurations. Rule packs give you production-ready rules maintained by experts.
| Component | Free Forever | Rule Packs |
|---|---|---|
| Scanning Engine | Full, unlimited | Same engine |
| CLI & VS Code | Complete tooling | Same tooling |
| Example Rules | 3-4 per vendor | 250-500+ rules |
| Write Your Own | Unlimited | Plus maintained rules |
| Compliance Mapping | DIY | Pre-mapped CIS, PCI-DSS, NIST |
| Updates | N/A | Quarterly + CVE patches |
Free Forever Means Forever
The core engine, CLI, VS Code extension, and ability to write unlimited custom rules will always be free and open source. No catch, no trial period, no feature gates.
Rule Packs Save Months
Writing production-grade rules takes deep vendor knowledge and compliance expertise. Our rule packs give you 500+ rules maintained by experts for a fraction of the cost of building them yourself.
Why Rule Packs?
You didn't become a network engineer to parse CIS benchmarks.
The Real Cost of DIY Rules
Time investment required to build production-ready validation rules
| Scenario | DIY Time | Consultant Cost | Rule Packs |
|---|---|---|---|
Single VendorBasic coverage | 40-80 hours1-2 weeks | $6,000-24,000@$150-300/hr | Deploy in minutes |
Multi-Vendor (5 platforms)Cisco, Juniper, Arista, etc. | 200-400 hours5-10 weeks | $30,000-120,000@$150-300/hr | $119/monthAll vendors included |
Your SavingsMulti-vendor scenario | Months of work | $28,000+ | Instant deployment |
Time to Value
Start scanning immediately instead of spending weeks researching vendor syntax, compliance requirements, and edge cases.
Predictable Costs
Fixed monthly pricing instead of unpredictable consultant hours. Know exactly what you're paying before you commit.
Expert Maintenance
Rules updated quarterly with new CVE patches, vendor updates, and compliance changes. No ongoing research required.
You didn't become a network engineer to parse CIS benchmarks.
Let us handle the rules so you can focus on securing your network.
Built in the Open
The core of SentriFlow is 100% open source under Apache 2.0. Use it freely, inspect the code, contribute improvements, or build your own tooling on top.
Core Engine
@sentriflow/coreThe heart of SentriFlow. A zero-dependency, high-performance parsing and validation engine that handles multi-vendor configurations with fault tolerance.
CLI Tool
@sentriflow/cliCommand-line interface for running validations, generating SARIF reports, and integrating with CI/CD pipelines. Supports JSON, YAML, and human-readable output.
VS Code Extension
sentriflow-vscodeValidate network configurations directly in VS Code with real-time diagnostics, vendor auto-detection, and rule management. Start validating configs immediately.
Join our community and help shape the future of network security validation
Create Your Own Rules
Build custom validation rules using TypeScript for complex logic or declarative JSON for simple patterns. Full IDE support, hot reload, and seamless integration.
Why Extensibility Matters
TypeScript Rules
Write powerful validation rules with full TypeScript support, IDE autocompletion, and type safety.
JSON Declarations
Define simple validation rules using declarative JSON format. No coding required for common patterns.
Community Sharing
Share and discover community-created rules through our open-source ecosystem on GitHub.
Hot Reload
Test your rules instantly with hot reload support. See validation results in real-time as you develop.
Start with JSON rules for quick validations, then upgrade to TypeScript when you need complex logic like cross-section dependencies or dynamic checks.
Example Rules
Create a custom rule to enforce SSH timeout configuration
import { Rule, ConfigContext } from '@sentriflow/core';
export const sshTimeoutRule: Rule = {
id: 'custom/ssh-timeout',
name: 'SSH Session Timeout',
severity: 'warning',
validate(ctx: ConfigContext) {
const sshConfig = ctx.findBlock('ip ssh');
const timeout = sshConfig?.get('time-out');
if (!timeout || parseInt(timeout, 10) > 60) {
return {
message: 'SSH timeout should be 60 seconds or less',
line: sshConfig?.line,
fix: 'ip ssh time-out 60'
};
}
}
};Choose Your Coverage Level
From essential security rules to comprehensive framework coverage. All tiers include cloud licensing, CLI access, and VS Code extension.
Prices in AUD
Basic
Essential Security Rules
or $350/year (save $70)
Core security validation rules for small teams starting their configuration validation journey. Includes CLI and VS Code extension access.
- >250 security validation rules
- Common misconfiguration detection
- CLI tool access
- VS Code extension
- Standard email support
- Community documentation
Professional
Advanced Framework Coverage
or $1190/year (save $238)
Validation rules mapped to major security frameworks. Includes offline pack support for air-gapped environments.
- All Basic features (+250 rules)
- ~250 additional framework rules
- Offline packs (30-day validity)
- Priority email support
- Basic validation reports
- Feed selection portal
Framework Coverage
Enterprise
Custom Validation Suite
Custom pricing for your needs
All framework coverage plus custom rulepack development tailored to your organization. Dedicated support and annual offline packs for mission-critical deployments.
- All Professional features & frameworks
- Custom rulepack development
- Organization-specific validation rules
- Annual offline packs (365-day validity)
- Custom integrations support
- Technical assessment reports
Framework Coverage
Need Rules Tailored to Your Organization?
Enterprise custom development for rules that match your specific needs. This is real engineering work, not template filling.
Frequently Asked Questions
Common questions about validation, compliance, and how Sentriflow helps your organization.
The SentriFlow engine, CLI, and VS Code extension are free forever. You can write unlimited custom rules yourself. Rule packs save you months of work by providing 500+ production-ready rules written and maintained by experts. You're not paying for the engine — you're paying for deep vendor knowledge, compliance expertise, and ongoing maintenance. Think of it like buying a professionally-written cookbook instead of creating every recipe from scratch.
Sentriflow automates the technical validation of your network devices, which is a major part of the PCI-DSS requirements. We provide the evidence you need to show your auditor that your configurations are secure, saving you weeks of manual evidence gathering. Final certification is issued by your Qualified Security Assessor (QSA).
No. Sentriflow is a validation tool that helps you assess and document your configuration posture against industry frameworks. We provide technical control assessments and validation reports. Official compliance certification must come from accredited auditors or certification bodies.
Our Professional tier provides validation rules mapped to NIST 800-53, PCI-DSS 4.0, and CIS Benchmarks. Enterprise tier includes all framework coverage plus custom rulepack development tailored to your organization's specific policies and requirements.
Validation confirms your configurations meet technical requirements — correct settings, proper hardening, no misconfigurations. Compliance is a formal status granted by auditors after reviewing your entire security program. Sentriflow handles validation; compliance requires additional organizational controls, policies, and formal certification.
12 Vendors, One Tool
Validate configurations across all major network vendors with a single, unified toolset. From enterprise switches to next-gen firewalls, we've got you covered.
Cisco
Enterprise routing, switching, and data center
Juniper
Enterprise and service provider networks
Aruba
Campus switching and wireless
Palo Alto
Next-generation firewalls
Arista
Cloud networking solutions
Fortinet
Security-driven networking
Extreme Networks
Enterprise and virtual switching
Huawei
Global network equipment
MikroTik
Cost-effective routing
Nokia
Service provider networks
NVIDIA
Open network operating system
VyOS
Open source network OS
Don't see your vendor? Request support on GitHub.
The core parser is open source — community contributions welcome!