Where to observe
An entire drive or selected paths, with folder and extension inclusions and exclusions.
Argus Sentinel
Riconoscere l’anomalia.Before it becomes widespread damage.
Sentinel observes file creation, modification, deletion and renaming in protected paths. It aggregates events, weighs them over time and turns unusual file activity into a clear operational signal.
SENTINEL
created · 18 file
renamed · 7 file
deleted · 12 file
ObservationWarningAlertIsolation
01 File events02 Weights and windows03 Four thresholds04 Configured response
Tunable sensitivity
Not every change is a threat. The overall behavior is what matters.
Each event type can carry a different weight. Sentinel deduplicates activity on the same file, groups it into time windows and compares the score with thresholds defined for each drive.
How to assess
Weights, debounce rules and time windows distinguish ordinary operations from anomalous sequences.
When to respond
Warning, Alert, strong response and isolation make the response progressively more severe.
Understand first
Learning mode helps tune thresholds and does not perform containment actions.
From the endpoint to the Monitor
Local protection. Central governance.
The endpoint observes activity and applies responses locally. The Monitor keeps configuration and runtime status separate, giving IT teams one view of drives, scope, learning and outcomes.
- Per-drive configuration with independent thresholds and scope
- Sentinel alerts are also available in the Timeline
- Canary Files adds high-sensitivity signals
- Process Activity Guard attributes activity to a process
01
ObserveEvents in paths and extensions within scope
continuous02
AggregateUnique files, weights and time windows
contextual03
ClassifyThe score determines the Sentinel level
progressive04
RespondAlert, notification or configured containment
governedCorrect interpretation
Sentinel does not attribute activity to the responsible process on its own.
The file channel detects what happens in protected paths. Process Activity Guard provides the correlation between process, user, action and path.
Speed and noise must be balanced.Lower thresholds detect activity earlier but may increase false positives. Focused scopes and learning mode help find the right balance.