ZonForge Sentinel — Features
Last updated: 2026-07-03 · Plain descriptions, no marketing language.
Core features
| Feature | What it actually does |
|---|---|
| AI alert investigation (Tier 1–2) | For every incoming alert, the AI analyst gathers context (identity, asset, historical behavior, related events), classifies it (benign / suspicious / confirmed threat), and writes an evidence trail explaining the decision. Runs on 100% of alerts, 24/7. |
| Log ingestion & normalization | Collects security-relevant events from 35+ sources via API connectors (agentless). Normalizes into a common event schema. |
| Threat detection | Detection rules plus behavioral analytics (UEBA) over identities and workloads. Focus areas: identity attacks (credential stuffing, MFA fatigue, token theft), cloud control-plane abuse, data exfiltration patterns, insider threats. |
| MITRE ATT&CK mapping | Detections and investigation findings are tagged with ATT&CK technique IDs so coverage can be audited against the framework. |
| Incident response automation | Playbooks trigger containment/notification actions (e.g., alerting via Slack, opening tickets, isolating access) when a threat is confirmed. Actions are configurable and can require human approval. |
| Threat hunting | Query interface over normalized events for proactive hunts; AI-assisted hunt suggestions. |
| Compliance reporting | Maps monitoring coverage and incidents to SOC 2, ISO 27001, HIPAA, PCI-DSS, and NIST CSF; generates audit-ready evidence reports. |
| Risk scoring | Continuous risk scores per identity/asset based on observed behavior and exposure. |
| MSSP multi-tenancy | MSP/MSSP console for managing multiple customer tenants from one interface, with per-tenant isolation. |
| Dashboards & reporting | Executive metrics, alert funnel, investigation timelines, and scheduled reports. |
Integrations (35+)
Pre-built connectors include: AWS CloudTrail, AWS GuardDuty, Azure / Microsoft Entra ID, GCP, Microsoft 365, Google Workspace, Okta, Salesforce, GitHub, Slack, Kubernetes, and Datadog. A REST API supports custom sources. Full current list: zonforge.com/features.
What is NOT included
- No endpoint agent (integrates with EDR tools instead of replacing them)
- No network appliance / packet capture
- No on-premises deployment
- No professional-services-dependent setup — self-serve onboarding is the standard path