SENTRY Pulse · CORRELATE

Know what’s happening across the threat surface: in context.

SENTRY Pulse is Armorstack’s security correlation layer and the operational instrument behind the Sentry Convergence Protocol. It brings supported signals together to help analysts understand activity in context. The full planned toolset is included upfront in one Managed Intelligence Provider (MIP) package: Fabric DISCOVER, Pulse CORRELATE, Miralto PROVE, and SENTRY AI ENFORCE. Activation follows supported scope and operational readiness, not optional tool-tier upsells. Existing verified capabilities remain distinct from expanded end-to-end infrastructure observability, which is awaiting live acceptance.

What Pulse Does

One correlation layer, not another dashboard

Pulse correlates available signal within a bounded window. Where supported integrations are active, analysts can connect identity, network, endpoint, and cyber-physical events. Coverage depends on enabled sources, agreed policy, and validated readiness; correlation is distinct from enforcement.

SIEM & Endpoint Telemetry

Normalized log and EDR signals from supported integrations, correlated within the configured window.

Network & Identity Signal

Supported network telemetry and identity activity feed a shared correlation window.

Cyber-Physical Correlation

Where Citadel integrations are enabled and validated, badge, camera, and intrusion events can add context to network and endpoint signals.

Client-Controlled Policy Boundaries

Agreed risk tiers and circuit-breaker caps define policy boundaries, with behavior validated before activation.

Tamper-Evident Audit Trail

Correlation records support review of available evidence within configured logging and retention scope.

Runs Inside Armorstack’s SOC

Pulse is the live instrument Armorstack’s own analysts work from: not a self-service tool handed over and left unsupported.

Three Layers, Not One

The standard, the instrument, and the enforcer

Sentry Convergence Protocol

The operating standard. Defines how Armorstack operates detection and response: the methodology, not the tool.

SENTRY Pulse

The instrument. Provides the live intelligence Armorstack uses to see and correlate the threat surface, right now, this page.

SENTRY AI

The enforcer. Where Pulse correlates supported threat signals, SENTRY AI applies AI-specific controls where enforcement is supported, enabled, and validated. See the SENTRY AI security platform →

Governance and evidence for all of this live in Miralto: Miralto observes and proves; Pulse correlates; SENTRY AI enforces within supported, validated scope.

See what Pulse would show you today.

Talk to Armorstack about deploying SENTRY Pulse across your environment.Talk to us

Talk through your situation

Book a short consultation to walk through your environment, the frameworks that apply to you, and a sensible first step. No pitch deck.

Book a consultation →

Prefer to start smaller? See how the 90-Day Proof works, or start with the SENTRY AI Security QuickScan.