SENTRY FIELD GUIDE
From a signal.
To a clear account.
Five questions to keep an identity investigation grounded.
What started the investigation?
Capture the original signal, the identity, the environment, and the relevant time window.
Which evidence is available?
Identify the sources you can review and the periods they cover. Keep evidence gaps visible.
What happened around the signal?
Connect the sign-in with email, file, application, and authentication activity. Build the sequence before summarising it.
What changed, and what remains?
Review the incident’s scope alongside the applicable response policy. Document access, persistence, and affected resources.
What can you explain?
Separate observed findings from inference. Record the response actions, the impact you can support, and the remaining questions.
MEET SENTRY
See the story.
Take the next step.
Explore a connected view of identities, investigations, and evidence.