Elastic SIEM
Direct Elasticsearch integration with per-customer credentials, hostname-field mapping, and lookback and polling control.
Bring the stack. Keep the context.
Connect the systems that already detect, enrich, notify and remediate. Sentendra keeps the source detail and gives analysts one place to work.
- IngestElastic, CrowdStrike, HTTP and webhooks
- EnrichVirusTotal, sandbox, NIST CVE and LLMs
- Actn8n, email, chat channels and webhooks
Ingest
Where alerts come from
CrowdStrike Falcon
Detection, search, agent, incident and event ID observable types, and alert ingestion via API.
Middleware API / custom HTTP
Route alerts through your own gateway, or wire any HTTP source with custom auth (Bearer, API key or header) and JSON path extraction.
AI models
A per-tenant choice
Tenant-isolated Ollama
Dedicated LLM inference inside your tenant for compliance-sensitive deployments. No third-party API calls. The default on paid plans.
OpenAI
Bring your own key for GPT-4o, GPT-4o-mini, GPT-4 Turbo or GPT-3.5, and run analysis under your own DPA.
Anthropic Claude
Bring your own key for Claude Haiku, Sonnet or Opus on the same per-tenant LLM toggle.
Enrichment
What the evidence means
VirusTotal
Hash, domain and IP enrichment with detection ratios, vendor verdicts, and last-analysis caching.
Sandbox detonation
Submit attachments for behavioural analysis and pull back YARA matches, MITRE mappings, IOCs and a threat score.
NIST CVE feed
A real-time CVE stream from the National Vulnerability Database, surfaced in the Command Center.
Action
Where the response goes
n8n workflows
Trigger n8n flows from case and alert events with HMAC-signed webhooks, and receive workflow callbacks.
Email (IMAP / SMTP)
Pull threads into cases and send out through templates with variable substitution, with per-customer mailbox config.
Slack, Teams, Discord, Telegram
Notification channels for case and alert events, with per-customer routing.
Generic webhooks
Inbound webhooks for alerts, cases and observables, and outbound webhooks for any external system, such as Jira, ServiceNow or PagerDuty.
Identity and access
Who gets in
SAML 2.0 / OIDC SSO
Enterprise IdP integration with PKCE and signed assertions: Okta, Azure AD, Auth0, Google Workspace and others.
API keys
Long-lived ib_* bearer tokens for programmatic access. Scope, rotate and revoke them from the UI.
Storage
Where files live
MinIO / S3-compatible
Object storage for case attachments, sandbox outputs and report artifacts.
Bring one real alert. We'll walk it to a closed case.
See Sentendra running on your own alerts in a 30-minute demo.