Look before the alert.
Back-scan available history with Sentry Scan to find earlier related activity.
FOR INCIDENT RESPONSE
Start with the signal.
Recover the story.
Reconstruct the entry, activity, persistence, and impact from the Microsoft 365 evidence available to you.
SEE THE INVESTIGATION
Your workflow.
In context.
Explore an illustrative investigation. Choose evidence, interpretation, or response.
Case 014 · illustrative investigation
Work backwards. Explain the whole incident.
- Initial accessEntra ID
Historical session activity establishes the starting point.
- Persistence addedExchange
A forwarding rule links access to mailbox activity.
- Scope establishedForensics
Connect affected resources and response actions.
CONTEXT CHANGES THE CONCLUSION
The alert is a starting point. Available historical evidence helps establish entry, persistence, activity, and impact.
Make evidence gaps explicit. The recorded facts determine the account you can give.
- Establish the entry
Trace the earliest related activity in retained logs.
- Scope the impact
Separate observed mailbox and file actions from unknowns.
- Hand over the account
Export findings and evidence with the remaining questions.
Sample workflow · no live response actionsJoin Waitlist
Know what you can say.
Separate the observed facts from evidence gaps. Preserve the sequence and explain the response.
PEOPLE + PLATFORM
A response team.
Alongside yours.
Sentry SOC is available 24/7 to investigate, coordinate remediation, and help resolve incidents under your agreed response policy.
START WITH A FREE SCAN
Curious what’s there?
Look back through up to six months of available history. Get a PDF summary and Excel evidence report.
MEET SENTRY
Make it your workflow.
Meet Sentry.
Join the waitlist for early access, shaped around your team and your environment.