From alert to analyst.
Illustrative workflow · from evidence to a human decision.
Receive
A Sentinel alert supplies the starting entities and investigation question.
Investigate
Agents follow procedures and request identity-gated, audited queries.
Enrich
Device posture, identity context and threat intelligence inform the assessment.
Document
Evidence, uncertainty and suggested next steps accompany the incident.
Review
An analyst checks the findings and approves the response; no automatic containment is implied.