Sentinel Enterprise is being made explicit: what is live, what is ops-assisted, and what is roadmap. This page is the source of truth for Enterprise evaluation and procurement conversations.
Agent decision history, review history, evidence bundles, replay references, and verifier scripts.
Generic, Splunk, Elastic, and Microsoft Sentinel-compatible JSON event formats.
Enterprise policy creation, listing, enable, and disable lifecycle through API.
AWS KMS signing custody and S3 Object Lock evidence storage are implemented behind provider interfaces and enabled per deployment.
| Feature | Status | Current Access |
|---|---|---|
| Enterprise evidence bundle | LIVE | GET /api/v2/agents/{agent_id}/enterprise/evidence-bundle |
| Decision history and export | LIVE | GET /api/v2/agents/{agent_id}/historyGET /api/v2/agents/{agent_id}/history/export |
| Review outcome history and export | LIVE | GET /api/v2/agents/{agent_id}/reviews/historyGET /api/v2/agents/{agent_id}/reviews/export |
| SIEM / SOAR export schema | LIVE | GET /api/v2/agents/{agent_id}/enterprise/siem-export?format=generic|splunk|elastic|sentinel |
| Custom policy lifecycle | LIVE | GET /api/v2/enterprise/policiesPOST /api/v2/enterprise/policiesPOST /api/v2/enterprise/policies/{policy_id}/enable|disable |
| Agent security scoring | LIVE | GET /api/v2/agents/{agent_id}/security-scoreAuthenticated, tenant-scoped, and computed from signed decision history. |
| Enterprise request limits | LIVE | No monthly cap. Default safety throttle: 3000 actions/min per agent. Sensitive actions: 60/hour per agent. Configurable by contract. |
| Private VPC / on-prem deployment | OPS | Available as engineering-assisted deployment, subject to contract and environment review. |
| SSO / SAML | ROADMAP | Not self-serve/live today. |
| AWS KMS signing custody | OPS | Implemented and deployment-ready for Enterprise environments using AWS KMS Ed25519 signing. Requires AWS key, IAM, region, public key metadata, and environment smoke verification before a tenant is described as KMS-backed. |
| S3 Object Lock immutable evidence storage | OPS | Implemented provider support. Enabled per deployment with customer-selected bucket, retention period, legal-hold policy, and IAM verification. |
| Dedicated CloudHSM / FIPS Level 3 custody | ROADMAP | Contract-scoped future provider. AWS KMS is the implemented v4 custody path today. |
| Multi-region active-active | ROADMAP | Current production is single-region. |
| Formal SLA with penalties | ROADMAP | Contract-required. No public penalty-backed SLA is published yet. |
Sentinel currently provides operational monitoring and priority Enterprise support by agreement. A penalty-backed uptime SLA must be defined in the customer contract before it is represented as guaranteed.
Current production governance data is stored in the active Sentinel production environment. Customer-specific residency, private deployment, or on-prem storage must be contract-scoped.