# SentraCore XDR Setup Guide

## Two setup roles

Use the correct setup for the correct user:

- Manager / Admin: `Setup SentraCore XDR.cmd`
- Employee endpoint: `SentraCore Employee Setup.cmd`

## Manager setup (dashboard host)

1. Run `Setup SentraCore XDR.cmd`.
2. Wait for dependency installation to finish.
3. The GUI opens at `http://127.0.0.1:5173`.
4. Keep this machine running as the manager dashboard host.

Main manager controls:

- `Launch SentraCore XDR.cmd`
- `Stop SentraCore XDR.cmd`

## Employee setup (auto-connect)

1. Manager creates an enrollment code from API:
   `POST /api/v1/onboarding/manager/bootstrap`
2. Employee runs `SentraCore Employee Setup.cmd`.
3. Employee enters enrollment code, name, and work email.
4. Setup registers device, saves agent config, and starts heartbeat service.
5. Device appears in manager tenant telemetry.

Main employee controls:

- `Launch SentraCore Employee Agent.cmd`
- `Stop SentraCore Employee Agent.cmd`

## What happens in GUI

- `Global Risk Score` is computed from backend risk snapshots, not frontend-only values.
- `Phishing Drill` creates backend events and updates alerts/users/timelines.
- `Endpoint Enrollment` shows total and online employee devices for the selected tenant.
- `Tenancy` means one isolated company workspace boundary.

## Real ingestion endpoints

- Manager bootstrap: `/api/v1/onboarding/manager/bootstrap`
- Employee register: `/api/v1/onboarding/register-device`
- Agent heartbeat: `/api/v1/onboarding/agent-heartbeat`
- Agent event telemetry: `/api/v1/onboarding/agent-event`
- External collector ingest: `/api/v1/events/ingest`

## If something fails

1. Confirm Python 3 and Node.js are installed.
2. Re-run setup for the affected role.
3. Check `logs\` for backend/frontend startup errors.
4. For employee enrollment, verify enrollment code and backend URL are correct.