How a case moves.

1. 01

   Ingest

   Hook up Elasticsearch directly, or any source through the Middleware API, custom HTTP or webhook. Sentendra polls each customer's index pattern on a per-customer schedule, normalises to ECS, runs hostname-field priority resolution, and auto-extracts 30+ observable types from the raw event JSON. Continuous uptime checks watch every connection.

   Case 1842 · 02:14:07The Elastic alert lands with the raw event, the Kibana link and the customer, Northwind, already attached.

2. 02

   Triage

   An 11-operator visual condition builder defines triage rules (auto-classify, set severity, assign) and exclusion rules (suppress noise per customer). Auto-dedup merges similar alerts inside a configurable window. User-acknowledged exclusions stop repeat notifications without losing the underlying detection. Only the alerts that need a person reach the queue.

   Case 1842 · 02:14:09Two duplicates merge in by hostname and rule. A triage rule sets severity to high and assigns the on-call analyst.

3. 03

   Enrich and analyse

   VirusTotal looks up hashes, domains and IPs. The sandbox detonates attachments and pulls back YARA matches and MITRE techniques. The AI engine, a tenant-isolated GPU model on paid plans or your own OpenAI or Anthropic key, classifies the case with a confidence score, reconstructs the attack-chain timeline, and grounds its reasoning in your own RAG knowledge base.

   Case 1842 · 02:15:02VirusTotal: 41 of 72 engines flag the hash. AI: true positive, confidence 0.92, mapped to T1003.001.

4. 04

   Respond

   Alerts promote into cases with tasks, SLAs and templates. n8n playbooks fire on case events for containment, ticketing or notification to Slack, Teams, Discord or email. Analysts collaborate without leaving the case: in-app chat, audio and video calls with recording, attachments, and per-case email threading over IMAP/SMTP.

   Case 1842 · 02:21:40The analyst approves the isolate-host playbook. n8n runs it and writes the result back to the case timeline.

5. 05

   Measure

   Dedicated MTTR and MTTD analytics with breach tracking. Customer-branded PDF reports (logo and colour theme) on demand or on a cron. The append-only audit log captures every privileged action with actor and IP, and exports into your own SIEM. Full uptime history for every integration.

   Case 1842 · 02:52:13Closed as contained. MTTR is 38 minutes, counted from the real detection time. The branded report goes to Northwind.

Case 1842 is an illustrative example.