Sentinel product benchmark
Three confirmed product outcomes. Every number is tied to a frozen baseline, raw counts, a published formula, and an automated reproduction test.
Verified by HLD
Confirmed results
No blended scores and no hidden weighting. Each result starts with raw counts and ends with a formula you can recalculate.
Sentinel identified 18 of 20 labelled attack scenarios, compared with 10 for the frozen fixed-signature baseline.
Recalculated from the frozen, expected-malicious scenario manifest; scenario IDs and detector mappings are asserted by the automated suite.
Sentinel consolidated 100 related alerts into 40 incident groups by target and time window.
Executed through Sentinel’s production clusterAlerts/triageAlerts path using frozen alert, target, tenant and timestamp fixtures.
Sentinel automatically routed 45 of 100 independent incidents that cleared both the critical-risk and high-confidence thresholds.
Executed through Sentinel’s production incident scoring and routing path; both score ≥85 and confidence ≥0.85 are required.
Verification protocol
A result is verified only when HLD’s automated benchmark reproduces it from frozen inputs and matches every raw count and formula shown here.
Corpus, expected labels, baseline behaviour, thresholds, and calculation rules are fixed before execution.
The baseline and Sentinel receive the same controlled inputs. Nothing is selectively removed after the run.
Automated tests assert the numerator, denominator, production-path result, and published percentage together.
A claim remains verified only while the benchmark repeats exactly against the named corpus version.
External comparison framework
Public, vendor-neutral references define the control, classify attack behaviours, and keep scoring consistent. Sentinel and the control receive identical inputs.
The control is limited to fixed signatures and indicators, following Sigma’s vendor-neutral rule structure and severity conventions. Behavioural baselining and cross-source correlation are disabled.
Sigma Specification 2.1.0Each eligible scenario is classified by adversary behaviour using MITRE ATT&CK Enterprise. Scenarios count once, even when multiple detectors fire, preventing duplicate alerts from inflating coverage.
MITRE ATT&CK Enterprise v19Detection, analysis, and routing are measured as separate outcomes. Following NIST guidance, we publish raw event, incident, and decision counts instead of a proprietary score.
NIST SP 800-61r3Detection corpus
The coverage test compares a fixed-signature rules baseline with Sentinel’s signature, behavioural, and correlation layers. A scenario counts once when at least one mapped detector produces the expected detection.
Test it in your environment
Run a scoped evaluation with the baseline, corpus, and acceptance criteria agreed in advance.
Join the public beta waitlist