System Sensor: Read and Verify Live IT Estate State

System Sensors are Panaptico’s always-on readers for your live IT estate. They poll accounts, devices, policies, configurations, and other fields across identity, cloud, network, security, endpoint, and data systems. Each read produces a current state snapshot that Panaptico compares against your declared target. The result is never silently assumed: every field is either at target, off target, unknown, or unobserved.

​

How System Sensors work

Sensors operate in three acquisition modes depending on the source:

• Ask — scripted API pulls against providers like Google Cloud, AWS, Okta, or Azure AD.
• Listen — log, metric, and event streams ingested via Cribl into your data lake.
• Test — active probes that verify behavior, including negative verification (for example, sending a packet and proving it is dropped).

After each read, Panaptico evaluates the field against your declared intent. If a firewall rule should allow only private ranges, the sensor checks sourceRanges. If the field is 0.0.0.0/0, the result is off target. If the provider API is unreachable or the field is not returned, the result is unknown or unobserved. Missing evidence never inherits a last good value and is never manufactured into a pass.

​

Result states

​

Example: Google Cloud firewall rule

You declare that a firewall rule should allow traffic only from private IP ranges. The System Sensor reads the rule and finds sourceRanges: ["0.0.0.0/0"]. Panaptico marks the field off target and surfaces the gap in the relevant Initiative. When you change the rule to sourceRanges: ["10.0.0.0/8"], the next sensor poll marks it at target and closes the gap automatically.

​

When to use System Sensors

Use System Sensors when you need continuous, field-level verification of configuration state across cloud, identity, network, endpoint, and security systems. They are the foundation for every other Panaptico primitive: Signals, Initiatives, and Routing all depend on sensor reads.