# Detection Signals

Beyond the core detection features, Sentinel exposes a set of supporting signals — each usable standalone via its own API endpoint, and each feeding into the overall risk score used by [Adaptive Captcha](/docs/sentinel/features/adaptive-captcha/) and the [Classifier](/docs/sentinel/features/classifier/).

## IP Resolution

Turns an IP address into geolocation and risk data — hosting-provider, proxy, Tor, and malicious-IP status — cross-referenced against [Threat Intelligence](/docs/sentinel/features/threat-intelligence/).

```
POST /v1/ip
{ "ip": "1.2.3.4" }
```

This is the feature; **which** external services actually resolve the data (MaxMind, ipinfo.io, Cloudflare, etc.) is configured separately — see [IP Resolvers](/docs/sentinel/integrations/ip-resolvers/).

## Header Entropy

Available since v1.31.0. Tracks how many distinct combinations of device-identifying headers a single device (per IP) sends over time, to catch attackers rotating headers to impersonate multiple different devices:

- `Accept-Language`
- `Sec-CH-UA`
- `Sec-CH-UA-Mobile`
- `Sec-CH-UA-Platform`
- `User-Agent`

It also scores **User-Agent commonality** — how common a given User-Agent string is against a known-identifier database — from low (uncommon, bot-like) to higher for widely-used browsers.

**Scoring:** each new header-combination profile seen from a device adds 1 point of risk/penalty by default, scaled by `headerEntropyRiskFactor`.

**Configuration** (via a Security Group's `set` rule, see [Schema](/docs/sentinel/configure/security-groups/#schema)):

| Field | Default | Purpose |
|---|---|---|
| `headerEntropyLimit` | `10/4h` (with Autopilot) | Rate limit on distinct header combinations before the request is rejected with `429`. |
| `headerEntropyRiskFactor` | `1.0` | Multiplier (0.0–10.0) applied to the risk added per new combination. |

| Variable | Default | Purpose |
|---|---|---|
| `HEADER_ENTROPY_MAX_ENTRIES` | `100` | Max header-combination hashes stored per IP. |

## Language Detection

Identifies the language of a piece of text — over 160 languages, roughly 3ms round-trip for short inputs.

```
POST /v1/language
{ "text": "..." }
```

Returns detected languages ranked by probability. Input over 400 characters is truncated; detection is more accurate on longer text, though 2–3 word phrases are often enough for major languages — submit a full sentence or paragraph where you can. This feeds the Classifier's `UNEXPECTED_LANGUAGE` rule (see [Classifier](/docs/sentinel/features/classifier/#text-classification-rules)).

## Links and Redirects

Puts a verification challenge in front of any URL — similar to Cloudflare's verification/interstitial pages. Visitors hit a short link at `/link/:slug`, complete a challenge, and only then get redirected to the real destination.

### Creating a protected redirect

1. In the admin interface, go to **Redirects → Create Redirect**.
2. Give it a name.
3. Set the destination URL.
4. Select the API Key whose Security Group governs the challenge type and rate limiting shown on this link.

### Custom fields

A protected redirect can require custom input fields before continuing — all fields are required. Field values can be substituted directly into the destination URL with `{field_name}` syntax (e.g. `{email}`).

Fields can also be evaluated by [AI Security Rules](/docs/sentinel/integrations/ai-security-rules/) for more nuanced checks — see [Usage with redirects](/docs/sentinel/integrations/ai-security-rules/#usage-with-redirects).

An optional footer link lets you reference your privacy policy or terms of service on the verification page itself.

## Related

- [Threat Intelligence](/docs/sentinel/features/threat-intelligence/)
- [IP Resolvers](/docs/sentinel/integrations/ip-resolvers/)
- [Adaptive Captcha](/docs/sentinel/features/adaptive-captcha/)
- [Rate Limiters](/docs/sentinel/features/rate-limiters/)
- [AI Security Rules](/docs/sentinel/integrations/ai-security-rules/)