Quiet, until there is reason not to be
Energy, transport, telecoms and water run around the clock. A false alarm at night costs a shift; a false block costs downtime. SENTINEL AI blocks nothing by itself and raises a case only when the evidence is sufficient.
What gets in the way today
Downtime costs more than the attack
An automatic block by mistake can stop a process.
No action runs without a person. For each one, the impact on operations and whether it can be undone are stated.
Planned work looks like an attack
Installing services and updates across the estate looks like an intruder digging in.
The platform knows about the change window, so planned work does not become an alert.
Mixed equipment
Windows, Linux servers and network equipment all log differently.
Windows through the agent, Linux and network gear through syslog, the rest through the API. One picture.
Built for sites that cannot stop
Offline
The platform runs in a closed network. The vulnerability database can be carried over as a file.
Decisive evidence
Bulk file encryption weighs ×60,000 and raises a case on its own, without waiting for corroboration.
Notification deadlines
The EU profile reminds you whom to notify about an incident and by when, with the source named.
930 events a second
What one 8-core server sustained in the load test; for more, PostgreSQL.
The platform watches the IT side: Windows, Linux servers, network equipment and network flows. It does not parse industrial protocols such as Modbus or DNP3.
Ransomware
A file runs from a temporary folder, then recovery points and backups are deleted and encryption begins. This is a real case from the platform.
- Program ran from a temporary folderT1204 · User Execution×605.7%
- Recovery points destroyedT1490 · Inhibit System Recovery×4,00099.6%
- Files being encrypted in bulkT1486 · Data Encrypted for Impact×60,000>99.9%
- Backup files destroyedT1490 · Inhibit System Recovery×2,500>99.9%
What the platform will propose
- Isolate the computer
Cuts the computer off from the network but keeps it running for investigation. The person using it loses access to shared resources.
- Stop the program
Ends the running program immediately. Unsaved work in it is lost and the evidence in its memory disappears.
- Capture the memory
Saves the computer's memory before anything is stopped, preserving proof.
Test it on your own data
A pilot runs on one server inside your network. You see what the platform finds there, and how many alerts stop reaching your analysts.
Request a pilot →