Catch every bad reading the instant it lands

Most monitoring stacks only know something is wrong when a query runs or someone is looking at the screen. Grafana paints a chart; the threshold breach happened ten minutes ago and the night shift never saw it. A pump runs past 150 PSI for twenty minutes before anyone notices, or a sensor goes dark and the flat-line just looks like steady-state. Polling-based checks evaluate on a schedule, not on the data — so the gap between 'reading arrived' and 'someone got told' is exactly when the damage gets done.

• Alerts fire when a query runs, not when the value crosses the line
• Offline sensors read as 'fine' — a missing reading is silent
• Multi-condition faults (high RPM AND high vibration) slip through single-metric charts

In Sentrel, every reading hits the rule engine on ingest — over MQTT or HTTPS batch — before it is ever stored or charted. You write conditions in plain terms against your typed schema: RPM>3000, pressure>150, vibration>8, temp_c>=85. Combine them with AND/OR for real fault signatures — high vibration AND high RPM, or low oil pressure OR over-temperature. An explicit is_online===false rule (and a heartbeat timeout) means a sensor that stops reporting trips an alert instead of disappearing quietly. A match routes straight to WebSocket, in-app toast, webhook, or email in the same instant the reading arrives.

• Threshold, out-of-range, and offline checks on the raw reading
• AND/OR conditions across multiple metrics for true fault patterns
• Offline / no-data detection, not just value breaches
• Fires to WebSocket, toast, webhook, and email on match

DIY stacks like Telegraf + InfluxDB + Grafana evaluate alerts on a timer and only on what they queried — you tune the interval and live with the lag. ThingsBoard's rule chains are real-time but you assemble and maintain the logic yourself. Sentrel ties the engine to ingest, so latency is the time it takes one reading to be checked, and the rules come from the same plain-English setup that generated your schema — no integrator, no PromQL, no rule-chain wiring. Every evaluation is recorded against the tamper-evident reading and audit trail, so when an alert fires you can prove exactly which value, at which timestamp, triggered it.

• Per-reading evaluation, not scheduled polling — no tunable lag
• Rules authored in plain English alongside your schema
• Each trigger tied to the integrity-hashed reading for full traceability