Find what changed.
See the sessions, mailbox rules, and authentication changes that need attention.
FOR IT TEAMS
Get them secure.
Get them working.
Resolve the identity incident without losing sight of the person trying to get back to work.
SEE THE INVESTIGATION
Your workflow.
In context.
Explore an illustrative investigation. Choose evidence, interpretation, or response.
alex.morgan@example.test
Access recovered. Persistence removed.
- Unexpected sessionEntra ID
Review access alongside the user’s usual activity.
- Inbox forwarding addedExchange
Messages are being sent outside the organisation.
- Recovery startedResponse
Contain access and review authentication methods.
CONTEXT CHANGES THE CONCLUSION
Restoring access is one step. Recovery also means removing the changes that could let an attacker return.
Keep account recovery, user communication, and the changes left behind in the same plan.
- Secure the account
Revoke sessions and reset compromised credentials.
- Clear the changes
Remove malicious rules and review authentication changes.
- Return to work
Coordinate recovery with the user and Sentry SOC.
Sample workflow · no live response actionsJoin Waitlist
Finish the recovery.
Work with Sentry SOC to contain the account, remove persistence, and coordinate the user’s return.
PEOPLE + PLATFORM
A response team.
Alongside yours.
Sentry SOC is available 24/7 to investigate, coordinate remediation, and help resolve incidents under your agreed response policy.
SENTRY SOCRESPONSE WORKSPACE
ANALYST-LED RESPONSE
Working the case.
- Review the evidenceScope and activity connectedInvestigate
- Coordinate the responseAccess and persistence addressedRemediate
- Bring it to resolutionActions and recovery reviewedResolve
MEET SENTRY
Make it your workflow.
Meet Sentry.
Join the waitlist for early access, shaped around your team and your environment.