Sentinel Watch — SOC Analyst Triage Console

Select an alert from the queue to view details.

Saved hunts: Failed logons (4625) Encoded PowerShell SMB from non-admin DNS TXT queries LSASS access Foreign IP egress

0 events Time range: last 24h Indexes: wineventlog · sysmon · suricata · auth · zeek

Timestamp	Source	Host	User	Event

MITRE ATT&CK Coverage — Last 24h

Heatmap of detected techniques across the kill chain. Cells indicate how many alerts in the queue mapped to each technique. Hover a cell to see the technique name.

No detections 1 alert 2 alerts 3+ alerts

Detection Rules

Sigma-format detection rules currently deployed to the SIEM. Click a row to view the rule logic. Rules are mapped to MITRE techniques and tagged by data source.

Rule	MITRE	Source	Severity	Hits 24h	Status