Detection rules tuned against real cloud-attack telemetry. Every alert ships with the raw audit event, the affected identity, the resource, the MITRE technique, and a recommended response action.
Sign-ins via legacy auth protocols (SMTP, IMAP, POP), MFA-claim manipulation, OAuth consent grants to unverified apps, conditional-access policy bypass via guest tenants, AAD primary refresh token theft signals.
Azure Global Admin actions outside change windows, break-glass account use without ticket reference, console login from new device or geography.
Unusual GET volume from a single principal, Blob access spike from outside expected ranges, snapshot exports, full-container sync attempts, SQL bulk exports without approved job.
New IAM users, new access keys, new service principals, or new role assignments created outside the IaC change window. Cross-references Terraform / Bicep state to catch click-ops drift.
Add-Member to privileged groups, AssumeRole into higher-privilege roles, role-policy patches that widen permissions, elevateAccess on Azure root, sudo / su patterns inside cloud-shell sessions.
Sudden egress spikes to external IPs, NAT gateway outbound bytes anomalies, cross-region replication enabled to untrusted accounts, public snapshot sharing, presigned-URL generation with multi-day TTL.
Same identity authenticating from two geographies in a window that violates physical travel time. Signals stolen credentials, session-token replay, or compromised refresh token. Tuned to suppress VPN / corporate proxy noise.
SENTINEL parses log payloads for credentials accidentally written to cloud logs — access keys logged from a misconfigured app, JWTs in error traces, connection strings in stack dumps. Auto-rotate hook into FORGE.
First-time-from-country, sign-ins from anonymizer / Tor exits, residential-proxy ASNs, cloud-provider source IPs (attacker pivot from compromised box), known threat-intel matches.
Push alerts where your team already lives. No rip-and-replace of your SIEM — SENTINEL is a high-signal source feeding what you already use.
Tail the audit log. Score the event. Route the alert. No agent on your hosts — SENTINEL lives in the API plane.
Subscribes to Azure Event Hubs (Activity Log) and Azure Event Grid Audit feeds. Streams events at line rate — no batched-poll latency.
Each event is enriched with identity context (AAD / IAM lookups), resource tags, geo-IP, threat-intel feeds, and historical baseline for the principal.
Detection rules tag each event against MITRE ATT&CK Cloud matrix (TA0001-TA0010). Severity is derived from blast radius, identity privilege, and asset sensitivity.
High-severity events fire to PagerDuty / Sentinel / Splunk in under 60 seconds. Medium / low events stream to Slack / Teams / email digest. Every alert links to one-click FORGE remediation.
In a real cloud environment running SENTINEL, the agent caught a privileged service principal being granted Owner on a production subscription 11 seconds after the Activity Log event landed — before the change had even propagated to the Azure portal UI. Alert fired into the customer's PagerDuty rotation, on-call engineer revoked the assignment in 4 minutes, FORGE generated the rollback. Total dwell time: under 5 minutes for what would have otherwise been an undetected privilege escalation.
“ SENTINEL beat our SIEM to the alert by an entire shift. ”
SENTINEL is included in every TITAN AI platform package. Detection without remediation and compliance evidence is just noise — we ship them together.