ZonForge Sentinel is an AI-native security operations platform for cloud and identity security, currently in pre-GA development. Teams evaluating alternatives to Splunk, Microsoft Sentinel and other SIEMs can see exactly what is live, in sandbox and in development on our Capability Status page.
Many SIEMs price by the volume of data ingested, so costs can rise quickly as cloud and SaaS log volume grows.
SIEM rollouts often take months of engineering work, plus ongoing rule tuning to keep false positives manageable.
High alert volumes mean analysts can manually investigate only a fraction of alerts, so real threats can be missed in the noise.
ZonForge Sentinel is designed around cloud and identity telemetry. Each capability below shows its current status from our capability registry.
Collectors for AWS, Microsoft 365 and Google Workspace perform real OAuth/SDK authentication and data pulls, but are not yet enabled in the production ingestion pipeline. GitHub and Cloudflare sources are planned.
Autonomous investigation is implemented with a real LLM agent, running in a service that is not yet in the production deployment. In-product views show clearly labelled sandbox activity.
Pre-GA reference pricing uses units such as identities, cloud accounts and team size — not gigabytes of ingested logs. Reference estimates on the pricing page are not a production checkout.
Detection rules such as impossible travel and privilege escalation run in a pipeline service that is not yet deployed. Figures shown in-product are synthetic.
Compliance scoring is a posture-derived model and ISO/SOC 2 mapping is heuristic — it is not a certified audit. Some report attestations are not yet live-verified.
Triage currently uses deterministic risk scoring (asset criticality, IOC, behavior), not model-based classification.
| What to evaluate | Why it matters | ZonForge Sentinel today |
|---|---|---|
| Pricing model | Volume-based pricing can grow with log volume | Reference pricing by identities, cloud accounts and team size; not per GB (pre-GA estimates) |
| Cloud and SaaS data sources | Coverage depends on which sources run in production | AWS, Microsoft 365 and Google Workspace collectors in development; GitHub and Cloudflare planned |
| Alert investigation | Determines how much manual analyst work remains | AI SOC analyst in sandbox; triage uses deterministic risk scoring |
| Detection content | Identity attacks often start with credential misuse | Rules such as impossible travel and privilege escalation in sandbox |
| Compliance reporting | Affects audit preparation effort | Heuristic ISO/SOC 2 mapping in sandbox; not a certified audit |
| Production availability | Whether the platform can carry production workloads today | Pre-GA; design-partner pilots by agreement |
Book a 30-minute demo. We'll walk through the sandbox and current capability status, and discuss whether a design-partner pilot fits your team.