SENTRY · Live Security Intelligence

Know what’s happening across the threat surface — in context.

SENTRY Pulse is Armorstack’s live security correlation layer — the operational instrument behind the SENTRY Convergence Protocol. It answers one question in real time: what is happening right now, and how does it connect to everything else?

What Pulse Does

One correlation layer, not another dashboard

Pulse pulls signal from across your environment into a single, bounded correlation window — so a badge anomaly at 2 AM can auto-pull the concurrent VPN sessions, and a lateral-movement alert can auto-pull the door logs and camera footage for the compromised space. No AI black-box: every correlation and enforcement decision is policy-driven and auditable back to the rule that fired.

SIEM & Endpoint Telemetry

Normalized log and EDR signal, correlated in real time rather than reviewed after the fact.

Network & Identity Signal

Network telemetry and identity activity feed the same correlation window as everything else — no separate silo.

Cyber-Physical Correlation

Badge swipes, camera events, and intrusion alerts from Citadel live inside the same data model as your network and endpoint telemetry.

Client-Controlled Policy Boundaries

You set the risk tiers and circuit-breaker caps. Pulse operates inside them — it cannot override a boundary you set.

Tamper-Evident Audit Trail

Every correlation and every enforcement action is logged in a record designed to be checked, not just trusted.

Runs Inside Armorstack’s SOC

Pulse is the live instrument Armorstack’s own analysts work from — not a self-service tool handed over and left unsupported.

Three Layers, Not One

The standard, the instrument, and the enforcer

SENTRY Convergence Protocol

The operating standard. Defines how Armorstack operates detection and response — the methodology, not the tool.

SENTRY Pulse

The instrument. Provides the live intelligence Armorstack uses to see and correlate the threat surface, right now, this page.

SENTRY AI

The enforcer. Where Pulse correlates the general threat surface, SENTRY AI finds and stops unsafe AI-specific activity — shadow AI, unsafe data flows, policy violations. See SENTRY AI →

Governance and evidence for all of this live in Miralto — Miralto observes and proves; SENTRY Pulse and SENTRY AI act.

See what Pulse would show you today.

Talk to Armorstack about deploying SENTRY Pulse across your environment.Talk to us