Platform Overview

Executive Summary

SentriScope is organized as a multi-tenant security intelligence platform with five conceptual layers: data ingestion, canonical normalization, intelligence correlation, investigation, and decision support. Each layer is tenant-scoped. Governance, access control, and auditability apply across the platform. AI assistance operates as a read-only, validated layer over existing canonical data—not as an autonomous decision engine.

Purpose

This document provides a conceptual map of the SentriScope platform for technical readers who need to understand how capabilities relate without implementation or internal component detail.

Problem Statement

Enterprise security platforms are difficult to evaluate when described only as feature lists. A stable conceptual model helps teams understand where ingestion, analysis, investigation, and decision support fit—and where human analysts remain accountable.

Industry Context

Security platforms typically span ingestion, normalization, analytics, workflow, and reporting. Mature programs expect tenant isolation, auditability, and explainable prioritization—not opaque scores or ungoverned automation.

SentriScope Perspective

The following conceptual layers describe SentriScope at a public-safe level of abstraction (D1). They are not internal service names or deployment diagrams.

┌─────────────────────────────────────────────────────────┐
│              Decision Support & Governance               │
│   Risk decisions, overrides, audit, explainability       │
└───────────────────────────┬─────────────────────────────┘
                            │
┌───────────────────────────▼─────────────────────────────┐
│              Investigation & Analyst Workspace           │
│   Evidence, sessions, attack path analysis, collaboration │
└───────────────────────────┬─────────────────────────────┘
                            │
┌───────────────────────────▼─────────────────────────────┐
│              Intelligence Correlation                    │
│   Threat intel, dashboards, CTI enrichment, context      │
└───────────────────────────┬─────────────────────────────┘
                            │
┌───────────────────────────▼─────────────────────────────┐
│              Canonical Normalization                     │
│   Assets, identities, exposures, controls, incidents     │
└───────────────────────────┬─────────────────────────────┘
                            │
┌───────────────────────────▼─────────────────────────────┐
│              Governed Data Ingestion                     │
│   Connectors, health, credential references, provenance  │
└─────────────────────────────────────────────────────────┘

Layer 1 — Governed data ingestion (implemented)

External security sources connect through governed connector sessions. Data arrives with operational state tracking and credential handling designed to avoid plaintext secret storage in application data.

Layer 2 — Canonical normalization (implemented)

Ingested data is normalized into shared entity concepts—assets, identities, vulnerabilities, exposures, controls, incidents, and threat intelligence—so analysts work across sources in one tenant-scoped model. See CANONICAL_DATA_MODEL.md.

Layer 3 — Intelligence correlation (implemented)

Threat intelligence enrichment, dashboard summaries, and correlation capabilities provide context for prioritization and investigation. Specific correlation depth varies by data source and tenant configuration.

Layer 4 — Investigation and analyst workspace (implemented)

Investigation workflows emphasize evidence and analyst-led analysis, including attack path analysis support. Conclusions require human validation.

Layer 5 — Decision support and governance (implemented)

Deterministic risk prioritization, explainability, override governance, and tamper-evident audit logging support accountable decisions. AI assistance does not replace this layer's deterministic scoring.

Cross-cutting foundations (implemented)

Current Capabilities

Current Limitations

• This overview is conceptual. It intentionally omits deployment topology, internal services, and scaling design.
• Not every domain has equal maturity; see PRODUCT_MATURITY.md.
• SBOM data ingestion is supported in part; dedicated SBOM UI is partially implemented.
• Advanced scenario intelligence and some organizational intelligence themes are planned or in progressive rollout.
• Operational intelligence and workforce automation capabilities exist in the product roadmap with varying maturity—not all are described in this overview.
• Connector count and supported sources should be taken from the registered connector catalog, not static marketing figures.

Frequently Asked Questions

How is SentriScope deployed?

SentriScope is offered as multi-tenant SaaS. Enterprise tenants may use dedicated database isolation depending on plan and configuration (implemented). Deployment internals are not part of public documentation.

Where does AI fit in the platform?

AI provides read-only assistance—primarily natural language querying over canonical data with validation. It does not drive deterministic risk scores.

Does the platform include a public and tenant-facing surface?

Yes. SentriScope separates public website, platform portal, and tenant access surfaces. Only approved public information appears on the public website.

Related Articles

• What is SentriScope?
• Canonical Data Model
• Product Maturity