Update Sentinel
Sign inStart free trial
Tech specs · Platform

Three tiers. Built to work disconnected.

One organization for your company, with every plant and site under it. A cloud console for planning and reporting, a relay at each site for content and coordination, and a lightweight agent on every machine.

Architecture

How the pieces fit.

Update Sentinel architecture with hostnames and portsA top-tier relay at your site connects outbound over HTTPS port 443 to relay.updatesentinel.com and downloads Microsoft update files from catalog.s.download.windowsupdate.com. Child relays connect to their parent relay on TCP 7443. Agents connect to their site relay on TCP 7443. An optional standby relay takes over if the active relay fails.Update Sentinel cloudapp.updatesentinel.comapi.updatesentinel.comcontrol panelrelay.updatesentinel.comrelay syncSites & usersPackagesOrchestrationInventoryPolicyAuditMicrosoft Update CDNcatalog.s.download.windowsupdate.comUpdate files, verified by SHA-256YOUR SITETop-tier relayCache, coordination, store-and-forward1HTTPS 443 to relay.updatesentinel.com, outbound only2HTTPS 443Child relayReaches an inner network3TCP 7443Standby relayTakes over if the active one failsAgentWindowsAgentLinuxAgentWindows ServerAgentWindows4TCP 7443, local subnetConnections1 Relay to our cloud2 Relay to Microsoft3 Child to parent relay4 Agents to relay
Sealed sites

No network path at all? Carry updates in on USB.

A transfer relay in your connected zone prepares signed bundles. The main relay in the sealed zone checks every file before anything installs.

USB transfer to a sealed siteIn the connected zone, a PC or laptop running the relay (the transfer relay) syncs with relay.updatesentinel.com and downloads Microsoft update files from catalog.s.download.windowsupdate.com, both over HTTPS port 443, and writes a signed transfer bundle to a USB drive. The drive is carried across the air gap to the main relay in the sealed zone, which verifies the bundle and serves the updates to its agents on TCP 7443. The sealed zone has no connection to the outside.Update Sentinel cloudrelay.updatesentinel.comMicrosoft Update CDNcatalog.s.download.windowsupdate.comCONNECTED ZONETransfer relayA PC or laptop running the relayWrites signed bundles to USB1HTTPS 4432HTTPS 443AIR GAPUSBSigned transfer bundleCarried across by handSEALED ZONE: NO OUTSIDE CONNECTIONMain relayVerifies every file in the bundleServes updates to the siteAgentAgentAgent4TCP 7443

Transfer relay

  • A PC or laptop running the relay, in a zone with internet access
  • Syncs approvals and downloads update files like any top-tier relay
  • Writes a signed transfer bundle to a USB drive

Signed transfer bundle

  • One file: manifest, content chunks and a detached signature
  • Tied to your organization; bundles for anyone else are refused
  • Every chunk hash and the signature are checked on import

Main relay, sealed zone

  • Imports the bundle and serves updates to its agents on TCP 7443
  • Needs no connection to the outside, and no firewall openings out
  • Same approvals, rings and maintenance windows as connected sites
Firewall rules

Every connection, with its host and port.

The numbers match the diagrams above. Only relays talk to the outside, and only outbound.

#
From
To
Port
Purpose
1Top-tier relay or transfer relayrelay.updatesentinel.comHTTPS 443, outboundSync with the Update Sentinel cloud: enrollment, approvals, rollout plans and results. Nothing connects inbound.
2Top-tier relay or transfer relaycatalog.s.download.windowsupdate.comHTTPS 443, outboundMicrosoft update files and the wsusscn2.cab scan catalog. The relay refuses downloads from any other host.
3Child relayIts parent relayHTTPS 7443Relay chains that reach networks behind other networks.
4AgentsTheir site relayHTTPS 7443Updates in, results out. The relay’s inbound rule is limited to the local subnet. Agents never need internet access.
5Your administrators’ browsersapp.updatesentinel.com, api.updatesentinel.comHTTPS 443The control panel. Relays never use these hosts.
6Your administrators’ browsersstusentovek5z.blob.core.windows.netHTTPS 443Installer downloads from the Downloads page.
7Top-tier relay or transfer relayThe download host of each catalog appHTTPS 443, outboundApproved third-party apps. Each app in the catalog lists its host.

Sealed sites need no rules to the outside: the main relay only listens on TCP 7443 for its own agents.

Cloud control plane

  • Your organization, its sites and users, packages, orchestration, inventory, policy and audit
  • Each customer gets its own organization; data and audit history are kept separate
  • Handles metadata only. Update binaries never pass through it
  • Microsoft CDN URLs and SHA digests resolved from the update catalog

Site relays

  • Chain 1..N tiers. Each polls only its parent
  • Adaptive polling with server hints and jitter
  • Durable store-and-forward queues while offline
  • Optional active/passive HA and peer chunk sharing
  • Per-relay storage budget with demand-based eviction

Endpoint agents

  • Inventory: hardware, software, patch state
  • Windows: offline scan with the Windows Update Agent and Microsoft's signed wsusscn2.cab
  • Linux: apt, dnf/yum and zypper
  • Actions: install package (OS updates and catalog apps), run signed script, self-update
Sync engine

Made for slow and unreliable links.

  • 4 MiB chunks, content-addressed by SHA-256
  • Deduplicated, so shared content is stored once
  • Immutable manifests with checkpoint and journal replay
  • Load shedding at the gateway under bursty demand
  • Signed transfer packages carry content across air gaps on removable media

WAN downloads for one update

Example: a site with 200 machines

Example: number of times one update crosses the WAN link at a 200-machine site
Each machine direct200 downloads
Update Sentinel relay1 download
Illustrative. The relay downloads each file once for its site.
Requirements

System requirements.

Component
Requirement
Windows agent64-bit Windows, win-x64. Requires the .NET 10 runtime. MSI installer, silent install supported.
Linux agentamd64 with systemd. Debian family (Debian, Ubuntu, Mint and others) via apt, RHEL family (RHEL, Rocky, Alma, Oracle Linux, Fedora, Amazon Linux) via dnf/yum, SUSE family (SLES, openSUSE) via zypper. .deb and .rpm packages.
RelayWindows Service or Linux systemd unit. Requires the ASP.NET Core 10 runtime. Disk sized to your storage budget.
Relay networkOutbound HTTPS to its upstream (the cloud or a parent relay). One inbound rule on TCP 7443 for agents, local subnet only.
Agent networkReaches its site relay on TCP 7443. No internet access needed.
BrowserAny current version of Edge, Chrome, Firefox or Safari for the web console.
Deploy

Silent installs, pinned keys.

  • The Downloads page gives you installers, the signing key's SHA-256 fingerprint and ready-to-paste commands
  • The signing key is pinned at install time
  • Each node then requests enrollment, and an admin approves it
# Windows endpoint agent (silent)
msiexec /i UpdateSentinelEndpointAgent.msi /qn `
  RELAYADDRESS=https://relay.site-a.example.com:7443/ `
  PACKAGESIGNINGKEY="<key from the Downloads page>"
Orchestration

How deployments run.

Rings with gates

Each ring has a minimum success percentage. The next ring starts only when the gate is met.

Windows and schedules

Plans carry a schedule window. Policy holds weekly or one-shot maintenance windows per time zone.

Journaled execution

Pause, resume and replay plans from an execution journal. Targeting fails closed.

Your next Patch Tuesday could be the easy one.

Set up a relay, add a few machines, and watch your first rollout finish on schedule.

Start your free trial
7-day free trial · No sales call needed