Sentinel Enterprise is being made explicit: what is live, what is ops-assisted, and what is roadmap. This page is the source of truth for Enterprise evaluation and procurement conversations.
Agent decision history, review history, evidence bundles, replay references, and verifier scripts.
Generic, Splunk, Elastic, and Microsoft Sentinel-compatible JSON event formats.
Enterprise policy creation, listing, enable, and disable lifecycle through API.
AWS KMS signing custody and S3 Object Lock evidence storage are implemented behind provider interfaces and enabled per deployment.
| Feature | Status | Current Access |
|---|---|---|
| Enterprise evidence bundle | LIVE | GET /api/v2/agents/{agent_id}/enterprise/evidence-bundle |
| Decision history and export | LIVE | GET /api/v2/agents/{agent_id}/historyGET /api/v2/agents/{agent_id}/history/export |
| Review outcome history and export | LIVE | GET /api/v2/agents/{agent_id}/reviews/historyGET /api/v2/agents/{agent_id}/reviews/export |
| SIEM / SOAR export schema | LIVE | GET /api/v2/agents/{agent_id}/enterprise/siem-export?format=generic|splunk|elastic|sentinel |
| Custom policy lifecycle | LIVE | GET /api/v2/enterprise/policiesPOST /api/v2/enterprise/policiesPOST /api/v2/enterprise/policies/{policy_id}/enable|disable |
| Agent security scoring | LIVE | GET /api/v2/agents/{agent_id}/security-scoreAuthenticated, tenant-scoped, and computed from signed decision history. |
| Enterprise request limits | LIVE | No monthly cap. Default safety throttle: 3000 actions/min per agent. Sensitive actions: 60/hour per agent. Configurable by contract. |
| Private VPC / on-prem deployment | OPS-ASSISTED | Engineering-assisted private VPC or on-prem deployment, subject to contract and environment review. |
| SSO / SAML | ROADMAP | Not self-serve or live today. |
| AWS KMS signing custody | DEPLOYMENT-READY | AWS KMS Ed25519 provider support is implemented and enabled per deployment after key, IAM, region, public metadata, and smoke verification. |
| S3 Object Lock immutable evidence storage | DEPLOYMENT-READY | S3 Object Lock provider support is implemented and enabled per deployment after bucket, retention, legal-hold, and IAM verification. |
| Dedicated CloudHSM / FIPS Level 3 custody | ROADMAP | Contract-scoped future provider. AWS KMS is the implemented v4 custody path today. |
| Multi-region active-active | ROADMAP | Multi-region active-active is not live today. Current production is single-region. |
| Formal SLA with penalties | ROADMAP / CONTRACT | No public penalty-backed SLA is offered today. Formal terms must be defined in the customer contract. |
Sentinel currently provides operational monitoring and priority Enterprise support by agreement. A penalty-backed uptime SLA must be defined in the customer contract before it is represented as guaranteed.
Current production governance data is stored in the active Sentinel production environment. Customer-specific residency, private deployment, or on-prem storage must be contract-scoped.
