Incidents, forensics & remediation

How a detected incident is tracked to a stated conclusion, what forensic help is available, and how a remediation quote works.

If you are in a live incident right now

Call your incident-response provider or the relevant authorities as appropriate. Sentinelleai's forensics is an analysis aid for your own responders, not an incident-response retainer, and nothing on this page substitutes for one.

The incident lifecycle

An incident moves through a small set of named states, and the platform is deliberately careful about the difference between two things that look alike from the outside: events stopping, and a cause being established. When events related to an incident simply stop, the incident is marked as stopped with an unknown cause — not resolved — because events ceasing could mean containment worked, the attacker finished and left, an agent process died, or the machine was unplugged. Those are different worlds, and collapsing them into one green checkmark would hide that.

Containment follows the same discipline. Firing a containment action does not, by itself, mark an incident contained: that state requires an observed effect, stated in words (the process was killed and confirmed gone, for example) — an action taken with no confirmed effect is recorded as "containment attempted", a distinct and weaker fact. And if new events appear after an incident was marked contained, it reopens rather than being treated as a fresh incident: the containment did not hold, and that is worth knowing on its own. Reaching a resolved state requires a stated cause; there is no path to resolved from silence alone.

Reaching a terminal state — resolved, or stopped with a stated cause — is also what triggers the customer report flow: a short notice goes out right away, and the full signed report follows after a hold window, unless an operator skips that delivery with a recorded reason. See Reports sent to you for what that report contains and what it stops short of.

The incidents list, showing states including open, investigating, contained and stopped unexplained — Containment is only recorded once an effect was actually observed, not merely attempted.

Evidence collection

When an incident opens, forensic artefacts are acquired at that moment rather than days later, when a process may already be gone. Each artefact is hashed (sha256) as it is captured, and the bundle as a whole carries a manifest hash computed over every artefact's name and hash together — so the bundle can be re-verified later against its own manifest, and any alteration after collection is detectable. An artefact that could not be captured — a process already gone by the time collection ran, for instance — is recorded as absent alongside what was captured, rather than silently missing from the bundle: an absent artefact is itself evidence about the state of the system at that moment, not a gap to paper over.

Threat hunting

A hunt asks a specific question of the telemetry already collected — for example, whether a particular pattern of credential access occurred. Every hunt returns one of three outcomes, not two: found, not found within a stated horizon, or cannot be asked. The horizon matters: "no sign of this in the last thirty days" is a strong claim, and it is only true if thirty days of telemetry are actually retained. A hunt whose question reaches further back than what is held returns "cannot be asked" rather than a false negative dressed up as a clean result.

Forensics on demand

For a real incident, a hosted forensic analyst is available as a separate capability. Small cases run on an always-on CPU server in the United States; a mid-sized or larger incident bursts to a GPU rented in the EU for the duration of the analysis. No hyperscaler and no Chinese-origin model sits anywhere in that path — the same rule this platform applies to every model it uses. Retention of the material submitted is short, and it is deleted afterward.

This is a hosted service, said plainly

Because the analysis runs on Sentinelleai's infrastructure by default, the material you submit — which can include credentials, attacker commands, or extracted data — does leave your own perimeter for the duration of the analysis. An own-endpoint tier exists for teams that need the model to run entirely inside their own environment instead.

Remediation quotes

When a finding is confirmed, you can receive a message that reports what was observed together with an optional, separable remediation quote. The message is explicit about what it is and is not:

What every remediation message says

"Sentinelleai is a monitoring vendor. We detected this activity; we did not cause it, and this message is not a request for payment. The evidence above is yours to verify independently — the same record can be handed to your own team, or to any other firm you choose, and either would reach the same diagnosis a Sentinelleai analyst would. The quote below is optional and separable from the diagnosis: the finding is offered whether or not you engage us, someone else, or no one at all to remediate it. We will not follow up on this message, and applying any fix — ours or another's — is entirely a decision for you to make on your own schedule."

Nothing in this path connects to your systems, signs a transaction, or deploys anything on your behalf. Generating and sending the message is automated; applying any fix is not, and never will be from here.

Accepting risk, suppressing, and false positives

A finding can be accepted as a risk you choose to carry, or suppressed as a false positive, from Findings. Both are critical actions: each requires a reason of at least ten characters and an explicit acknowledgement, and both are recorded with your identity in the evidence ledger. Accepting a risk additionally requires a review date — an acceptance with no end is indistinguishable from simply forgetting about it, so the platform refuses to record one that never comes back for review. Findings marked as false positives are tracked separately at Suppressions.

A finding's action panel, showing accept-risk and suppress with a required reason — Reducing a finding's status — accepting or suppressing it — always requires a stated reason.

What this stops short of

A hunt only sees what was retained; a question about a longer window than the retained history is answered as unanswerable, not as clean.
An evidence bundle proves what was captured and that it has not been altered since — it does not prove an artefact that could not be captured never existed.
The hosted forensic analyst is an aid to your own investigation and decision-making, not a determination of fault, liability, or a substitute for professional incident response.
A remediation quote is a proposal in prose and steps — nothing here applies a fix automatically.