Sentris Flow
An open-source, self-hosted platform where security teams drag and drop building blocks to automate scans, alerts, and investigations — instead of stitching together scripts by hand.
🔗 Visit Sentris Flow
Description
Most security teams end up automating repetitive work — scanning a list of domains, checking new code for secrets, watching logs for a pattern — with a pile of cron jobs and one-off scripts that only the person who wrote them understands. Sentris Flow replaces that pile with a visual, no-code builder: you connect boxes on a canvas ("scan this", "if X, alert here", "wait for a human to approve") and it runs the resulting workflow reliably, resuming automatically if a step fails or the server restarts.
Under the hood it uses Temporal.io for durable, resumable execution, so a multi-hour workflow survives a crash without losing its place. Each step runs in an isolated, ephemeral Docker container, and the platform ships with 34 built-in security components (Nuclei, Trivy, Semgrep, TruffleHog, Subfinder, and others) plus 30 pre-built workflow templates to start from. It supports human-in-the-loop pauses for approval steps, native CRON scheduling for recurring workflows, a REST API for triggering and monitoring runs, real-time telemetry over SSE, and optional AI-driven analysis nodes via MCP providers (including AWS CloudTrail and CloudWatch integrations) for teams who want an LLM to help triage findings.
💬 Our review
The short version: if your team is duct-taping shell scripts together to run recon and vulnerability scans on a schedule, Sentris Flow gives you a proper orchestration layer for that — for free, self-hosted, with the resilience of a real workflow engine instead of a cron job that silently dies.
Its closest comparison isn't really another security product but general-purpose workflow tools like n8n or Temporal itself: Sentris Flow is narrower (built specifically around security tooling, with 34 security integrations out of the box) but that specialization is the point — you don't have to wire up Nuclei or TruffleHog yourself. The tradeoff is that it's a young, community project rather than a funded commercial platform: no formal support contract, no SLA, and you're responsible for hosting and securing it yourself (containers with access to scanning tools are worth locking down carefully). For a solo researcher or a small security team comfortable running Docker, it's a legitimate free alternative to paying for a commercial SOAR platform; for an enterprise needing vendor support, it's better as a component to evaluate than a drop-in replacement.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Auto-hébergé, aucune licence formelle publiée, code source disponible sur GitHub.
Pros
34 intégrations sécurité prêtes à l'emploi (Nuclei, Trivy, Semgrep, TruffleHog...)
Exécution durable via Temporal.io — reprend après un crash sans perdre sa place
Gratuit, open source, auto-hébergeable, containers isolés par étape
Cons
Projet communautaire jeune, pas de support commercial ni de SLA
Auto-hébergement à sécuriser soi-même (containers avec accès à des outils de scan)
Documentation et écosystème plus restreints qu'une plateforme SOAR commerciale