The last line that never blinks. A kernel-deep C++ endpoint agent that watches every channel data can escape through — clipboard, browser, USB, keyboard, screen capture, network flows, archives — and stops exfiltration the instant it's classified, with zero performance tax. Backed by statistical UEBA, AI-driven triage, and full SIEM export.
live interception
Every transfer is classified in microseconds at the kernel boundary. Safe files pass; sensitive data hits the wall. Change the policy and watch enforcement adapt in real time.
capabilities
12 detection modules run as an in-process EventBus. Each can be toggled in config.json. Click any card to inspect.
On-demand + scheduled scans of user directories. Content regex/keyword match, reads MIP/AIP sensitivity labels.
Watches the system clipboard for sensitive data in real time. Scans text against all active policy patterns.
Chrome/Edge/Firefox extension scans web uploads and pastes before data leaves the browser page.
Detects USB mass-storage attach/detach via WMI. USB File Guard blocks confidential file copies.
Low-level WH_KEYBOARD_LL hook scans typed text against policy patterns as user types.
Detects screenshot and recording tools running on the endpoint.
Detects archive creation via WMI process monitoring for 7z, WinRAR, zip, tar processes.
TCP/UDP flow metadata via GetExtendedTcpTable + eStats, process-correlated.
ETW-based network and file telemetry using the NT Kernel Logger session.
Tracks confidential data as it's appended or copied into new files across the filesystem.
Consumes Sysmon event log and maps interesting EventIDs into DLP events.
Optional sentinel_filter.sys driver for real-time file events below user space.
> file_scanner ........ ENFORCED
> clipboard_guard ..... ON
> usb_file_guard ...... STRICT
> keyboard_monitor .... ON
> screen_capture ...... ON
> browser_bridge ...... ENFORCED
> taint_tracker ....... ACTIVE
> cpu_overhead ........ < 1%
how it works
Sentinel sits where the data moves. Every transfer is classified against policy in microseconds, then allowed, flagged, or blocked — locally, before anything ever leaves the endpoint. Three enforcement tiers give granular control.
architecture
All traffic is HTTPS with certificate pinning. Policy syncs via 304 caching. Heartbeats deliver directives. Click any node to inspect.
taint engine
Sentinel doesn't just classify files — it tracks processes. If a process opens a confidential document, it becomes "tainted". All its subsequent clipboard, keyboard, network and screen operations are elevated to high-risk regardless of content.
> PID 4812 (excel.exe) opened Confidential file
> → taint applied: PID 4812 TAINTED
> PID 4812 → clipboard copy detected
> → action: BLOCK (clipboard wiped)
> PID 4812 spawned PID 5108 (7z.exe)
> → taint inherited: PID 5108 TAINTED
> PID 5108 created archive.7z
> → ADS tag written: :sentinel_dlp_tag
> → classification: CONFIDENTIAL
behavioral analytics
Traditional DLP matches text patterns. Sentinel's UEBA builds per-user statistical baselines and flags deviations using z-scores, cosine-similarity on document vectors, and content-aware category profiling.
ai-powered
An integrated AI analyst triages incidents, queries data, drafts policies and behavior rules. Supports OpenAI, Anthropic and Ollama. API keys encrypted at rest with Fernet.
> logic: AND
> • filter : module = clipboard_monitor
> • count : ≥ 3 events within 300s
> • scope : same username
> severity: HIGH
> action: BLOCK
> email: soc@company.com
> on fire → restriction directive
> agent enforces on next heartbeat
correlation engine
Correlate incidents over time with a visual block builder. Combine filters, counts, sequences, distinct modules and distinct values with AND/OR logic. When a rule fires, the server pushes a restriction directive the agent enforces on the user's next heartbeat.
enforcement model
Three action levels — log, warn, block — apply to every detection channel. A block only fires when an enabled policy of that channel owns the matched rule. Here's what "block" does per channel:
> console_auth ...... JWT HttpOnly + CSRF
> agent_auth ....... bearer + cert pin
> refresh_tokens ... Redis JTI revoke
> RBAC ............. admin/analyst/viewer
> encryption ....... Fernet (AES-128-CBC)
> audit_log ........ hash-chained
> rate_limits ...... login/TOTP/events
> cookies .......... Secure + SameSite
> SIEM_export ...... CEF/TCP-TLS
> config_at_rest ... DPAPI encrypted
> --host ••••••••
> --enrollment-key ••••••••
> --sign-key sentinel-signing-key.xml
> TLS pin auto-derived from server.crt
> bundling: agent + sysmon + extension
> → SentinelDLP-Setup.exe (signed)
> install as Administrator
> auto-enroll → bearer token → policy pull
> status: ONLINE in Agents dashboard
deployment
A single build script bundles the agent, Sysmon, the browser extension and a signed config into one distributable EXE. TLS pinning is auto-derived from your server certificate.
console & integrations
At-a-glance posture: incident counts by severity, active agents, recent activity, top modules and users — the landing view after login.
Full lifecycle: open → investigating → acknowledged → closed / false_positive. Bulk-acknowledge, evidence linking, auto-escalation to CRITICAL.
Every module observation is dual-written to raw_events. Filterable by module, hostname, process, file path, URL, severity, time range.
Incidents emitted as CEF syslog to QRadar or any SIEM. TCP-TLS, TCP or UDP transport. Severity, module, action, user and evidence mapped per CEF spec.
SMTP with STARTTLS/SSL. Invite emails, policy incident alerts, behavior rule notifications and UEBA anomaly reports — all configurable per-rule.
Hash-chained audit log of sensitive actions. Each entry links to the previous via SHA-256 — verifiable via the /audit/verify API endpoint.
get started
Book a Sentinel DLP demo for your Windows & macOS fleet. A native Linux agent is on the way — register your interest now.