./products/sentinel_dlp
Active · Win / macOS

Sentinel DLP

The last line that never blinks. A kernel-deep C++ endpoint agent that watches every channel data can escape through — clipboard, browser, USB, keyboard, screen capture, network flows, archives — and stops exfiltration the instant it's classified, with zero performance tax. Backed by statistical UEBA, AI-driven triage, and full SIEM export.

Request Demo Linux Agent · Coming Soon
sentinel — endpoint agent · host-fin-07live
> live data-flow monitorkernel hook ✓
throughput 0% impact · 12 modules active
clipboard → web uploadBlocked
credit_card.csv → USBBlocked
report.pdf → approved driveAllowed
api_key in chat draftFlagged
[SENTINEL]: 2 exfil attempts stopped · 0 false positives
0
Detection modules
0%
CPU overhead
0%
False positives
0
Enforcement tiers

live interception

Watch the data try to leave

Every transfer is classified in microseconds at the kernel boundary. Safe files pass; sensitive data hits the wall. Change the policy and watch enforcement adapt in real time.

◧ ENDPOINT · host-fin-07sentinel policy engineEXIT · network / usb ▸
SENTINEL
0Blocked
0Allowed
0Scanned

capabilities

Nothing leaves unseen

12 detection modules run as an in-process EventBus. Each can be toggled in config.json. Click any card to inspect.

01

File Scanner

On-demand + scheduled scans of user directories. Content regex/keyword match, reads MIP/AIP sensitivity labels.

Block action: delete file + bilingual notification. Computes content profile (categories + Shannon entropy) for UEBA. Supports file_extensions filter.
[ click to inspect ]
02

Clipboard Monitor

Watches the system clipboard for sensitive data in real time. Scans text against all active policy patterns.

Block action: empties the clipboard immediately + bilingual user notification (English first, then Ukrainian). Tainted process clipboard ops are elevated.
[ click to inspect ]
03

Browser Bridge

Chrome/Edge/Firefox extension scans web uploads and pastes before data leaves the browser page.

Localhost REST server authenticated with X-Bridge-Token + origin checks. Hard-block only fires when a network policy owns the match. Extension served via /api/v1/extension.
[ click to inspect ]
04

USB Device Control

Detects USB mass-storage attach/detach via WMI. USB File Guard blocks confidential file copies.

Two sub-modules: usb_monitor (device detection) and usb_file_guard (content-aware block). Block action: delete file on USB + "access denied" notification.
[ click to inspect ]
05

Keyboard Monitor

Low-level WH_KEYBOARD_LL hook scans typed text against policy patterns as user types.

Block action: erases matched content by injecting VK_BACK keystrokes in real time. Bilingual notification. Critical for preventing credential/PII entry into untrusted apps.
[ click to inspect ]
06

Screen Capture Guard

Detects screenshot and recording tools running on the endpoint.

Instead of killing processes, blacks out confidential windows using SetWindowDisplayAffinity (WDA_EXCLUDEFROMCAPTURE) — Netflix-style DRM protection for your data.
[ click to inspect ]
07

Archive Monitor

Detects archive creation via WMI process monitoring for 7z, WinRAR, zip, tar processes.

Inherits the Confidential ADS tag onto produced archives automatically. Block action: delete the archive + notification. Prevents exfiltration via compressed containers.
[ click to inspect ]
08

Network Flow

TCP/UDP flow metadata via GetExtendedTcpTable + eStats, process-correlated.

Polls, diffs snapshots, emits one event per closed or long-running flow with bytes_sent, bytes_recv, ports, and process name. Configurable watched ports and large-transfer thresholds.
[ click to inspect ]
09

ETW Network

ETW-based network and file telemetry using the NT Kernel Logger session.

Owns the system-wide NT Kernel Logger session for real-time, low-level tracing of file I/O and network connections. Provides kernel-level visibility that user-space APIs cannot match.
[ click to inspect ]
10

Data Lineage

Tracks confidential data as it's appended or copied into new files across the filesystem.

Propagates Confidential classification along the full lineage chain. If tainted_process.exe writes to new_file.docx, the new file inherits the tag. Works with ADS tagger.
[ click to inspect ]
11

Sysmon Integration

Consumes Sysmon event log and maps interesting EventIDs into DLP events.

Maps ProcessAccess, network connections, and file events from Sysmon. Tuned filtering suppresses OS noise and false positives. Sysmon is bundled in the installer.
[ click to inspect ]
12

Kernel Minifilter

Optional sentinel_filter.sys driver for real-time file events below user space.

User-space client connects to \\SentinelDLPPort communication port. Intercepts file I/O at the filter manager level — nothing can bypass via user-space hooks. Toggle: kernel_driver in config.
[ click to inspect ]
sentinel.policy
soras@corp:~$sentinel --policy show

> file_scanner ........ ENFORCED

> clipboard_guard ..... ON

> usb_file_guard ...... STRICT

> keyboard_monitor .... ON

> screen_capture ...... ON

> browser_bridge ...... ENFORCED

> taint_tracker ....... ACTIVE

> cpu_overhead ........ < 1%

AGENT ENFORCING

how it works

Classify. Decide. Enforce.

Sentinel sits where the data moves. Every transfer is classified against policy in microseconds, then allowed, flagged, or blocked — locally, before anything ever leaves the endpoint. Three enforcement tiers give granular control.

  • Observe at the kernelHook file, clipboard, browser, keyboard and device I/O with full fidelity via minifilter driver + ETW + WMI.
  • Classify in real timeMatch content against PII, credentials, MIP/AIP labels and custom regex/keyword patterns. Compute content profile + Shannon entropy.
  • Enforce by policyThree action levels: log (record only), warn (bilingual notification), block (prevent + delete/wipe/erase). Your rules, your thresholds.
  • Report & auditEvery decision logged to raw_events, exported to SIEM as CEF, and available for AI analyst triage.

architecture

End-to-end data flow

All traffic is HTTPS with certificate pinning. Policy syncs via 304 caching. Heartbeats deliver directives. Click any node to inspect.

sentinelDLPpolicy engine
endpointsentinel_agent.exeC++ service · EventBus
local enforcement · driver
guardianwatchdog processmutual pipe monitor
auto-restart on kill
browserChrome / Edge / FirefoxX-Bridge-Token auth
upload + paste scan
backend (fastapi)/enroll · /eventsTLS-pinned · RBAC
policy sync (304)
console (spa)React + ViteJWT cookie + CSRF
policies · incidents · AI
siem exportsyslog / CEFCEF over TCP-TLS
auto-emit incidents
PostgreSQL (partitioned)
Redis (revoke / limit)
Fernet · DPAPI at rest

taint engine

Taint tracking & ADS tagging

Sentinel doesn't just classify files — it tracks processes. If a process opens a confidential document, it becomes "tainted". All its subsequent clipboard, keyboard, network and screen operations are elevated to high-risk regardless of content.

  • Process taint inheritancePIDs that touch confidential data are tainted. Spawned child processes inherit the taint across the full process tree.
  • NTFS ADS classificationA JSON tag is written to the :sentinel_dlp_tag Alternate Data Stream. The label survives in-volume moves, renames, and copies.
  • Data lineage propagationWhen tainted data is appended or copied into new files, the Confidential classification propagates along the entire lineage chain.
  • Archive inheritanceArchives created from tagged files inherit the tag automatically — 7z, WinRAR, zip and tar are all covered.
taint_tracker.log
sentinel:taint$--watch --verbose

> PID 4812 (excel.exe) opened Confidential file

> → taint applied: PID 4812 TAINTED

> PID 4812 → clipboard copy detected

> → action: BLOCK (clipboard wiped)

> PID 4812 spawned PID 5108 (7z.exe)

> → taint inherited: PID 5108 TAINTED

> PID 5108 created archive.7z

> → ADS tag written: :sentinel_dlp_tag

> → classification: CONFIDENTIAL

TAINT ENGINE ACTIVE
UEBA Live Profiler

behavioral analytics

UEBA — beyond signatures

Traditional DLP matches text patterns. Sentinel's UEBA builds per-user statistical baselines and flags deviations using z-scores, cosine-similarity on document vectors, and content-aware category profiling.

  • Z-score anomaly detectionPer metric, UEBA learns mean/stddev baselines. Observations exceeding configured z-score thresholds (medium/high/critical) raise anomalies.
  • Content-aware cosine deviationThe user's document vector is compared to their baseline profile. 1 − cosine = deviation. Above threshold → incident; above block threshold → restriction directive.
  • Atypical access detectionAccessing a content category never seen in the user's baseline raises an immediate access anomaly.
  • MIP/AIP integrationMicrosoft Information Protection sensitivity labels are an authoritative category source for the content analysis engine.
  • Configurable categoriesDefine content categories with bilingual keywords (English + Ukrainian). Set deviation/block sliders and email notification recipients.

ai-powered

AI analyst co-pilot

An integrated AI analyst triages incidents, queries data, drafts policies and behavior rules. Supports OpenAI, Anthropic and Ollama. API keys encrypted at rest with Fernet.

  • Read tools (inline)Search incidents, get detail, list UEBA anomalies, get user baselines, list policies/rules/agents/users/groups, search raw events, get stats.
  • Mutating tools (approval gate)Create policy, create behavior rule, update incident status, send_email_notification — the AI proposes, you approve.
  • Chat sessions with memoryPer-user conversation history, structured quiz mode when intent is ambiguous, and persistent remember/recall memory.
  • Scheduled AI tasksAutomate recurring analysis: cron-based summaries, event-triggered triage, interval-based reporting — combine with email for automated SOC workflows.
AI Analyst · Interactive Demo ready
Choose a prompt below to see the AI analyst in action. This is a simulation of the real Sentinel DLP AI co-pilot.
behavior_rule.config
sentinel:rules$--show rule_id=7

> logic: AND

> • filter : module = clipboard_monitor

> • count : ≥ 3 events within 300s

> • scope : same username

> severity: HIGH

> action: BLOCK

> email: soc@company.com

> on fire → restriction directive

> agent enforces on next heartbeat

RULE ACTIVE

correlation engine

Behavior rules — visual correlation

Correlate incidents over time with a visual block builder. Combine filters, counts, sequences, distinct modules and distinct values with AND/OR logic. When a rule fires, the server pushes a restriction directive the agent enforces on the user's next heartbeat.

  • Rate / thresholdN matching events within a time window from the same user.
  • SequenceModule A then module B for the same user within a window — detect multi-step exfiltration patterns.
  • Distinct modulesEvents from N different modules — flag multi-channel activity.
  • Distinct valuesN distinct values of a field (e.g. many different destination URLs).
  • Email on fireSet "Send to email incidents" to notify SOC recipients instantly when a behavior rule triggers.

enforcement model

Block per channel, every channel

Three action levels — log, warn, block — apply to every detection channel. A block only fires when an enabled policy of that channel owns the matched rule. Here's what "block" does per channel:

  • File / archive / USBDelete the file + "you don't have access" bilingual notification (English + Ukrainian).
  • ClipboardClear the system clipboard + notify.
  • KeyboardErase matched typed content by injecting backspaces + notify.
  • Screen captureBlack out confidential windows using SetWindowDisplayAffinity (no process kill).
  • NetworkCan't hard-block → notification + event.
  • Behavior / UEBAServer pushes restriction directive; agent enforces (notify/lock) on next heartbeat.
security_model.spec
sentinel:sec$--verify-all

> console_auth ...... JWT HttpOnly + CSRF

> agent_auth ....... bearer + cert pin

> refresh_tokens ... Redis JTI revoke

> RBAC ............. admin/analyst/viewer

> encryption ....... Fernet (AES-128-CBC)

> audit_log ........ hash-chained

> rate_limits ...... login/TOTP/events

> cookies .......... Secure + SameSite

> SIEM_export ...... CEF/TCP-TLS

> config_at_rest ... DPAPI encrypted

SECURITY VERIFIED
build_windows.bat
C:\agent>scripts\build_windows.bat

> --host ••••••••

> --enrollment-key ••••••••

> --sign-key sentinel-signing-key.xml

> TLS pin auto-derived from server.crt

> bundling: agent + sysmon + extension

> → SentinelDLP-Setup.exe (signed)

> install as Administrator

> auto-enroll → bearer token → policy pull

> status: ONLINE in Agents dashboard

BUILD SUCCESSFUL

deployment

Build once, deploy everywhere

A single build script bundles the agent, Sysmon, the browser extension and a signed config into one distributable EXE. TLS pinning is auto-derived from your server certificate.

  • One-line buildbuild_windows.bat --host --enrollment-key --sign-key. Produces SentinelDLP-Setup.exe.
  • Auto-enrollmentRun the installer as Administrator. Agent auto-enrolls, receives a bearer token, pulls policy and starts enforcing.
  • Self-protecting watchdogA second process mutually monitors the service over a named pipe and auto-restarts it if killed.
  • Virtual Service AccountAgent can run under a hardened VSA, dropping SYSTEM/SeDebug privileges where possible.
  • Optional code signingPass --code-sign-pfx for Authenticode signing of the installer EXE.

console & integrations

Manage everything from one surface

01

Dashboard

At-a-glance posture: incident counts by severity, active agents, recent activity, top modules and users — the landing view after login.

02

Incident Management

Full lifecycle: open → investigating → acknowledged → closed / false_positive. Bulk-acknowledge, evidence linking, auto-escalation to CRITICAL.

03

Event Search

Every module observation is dual-written to raw_events. Filterable by module, hostname, process, file path, URL, severity, time range.

04

SIEM / CEF Export

Incidents emitted as CEF syslog to QRadar or any SIEM. TCP-TLS, TCP or UDP transport. Severity, module, action, user and evidence mapped per CEF spec.

05

SMTP Email Alerts

SMTP with STARTTLS/SSL. Invite emails, policy incident alerts, behavior rule notifications and UEBA anomaly reports — all configurable per-rule.

06

Tamper-Evident Audit

Hash-chained audit log of sensitive actions. Each entry links to the previous via SHA-256 — verifiable via the /audit/verify API endpoint.

get started

Lock down the last mile

Book a Sentinel DLP demo for your Windows & macOS fleet. A native Linux agent is on the way — register your interest now.

Request Demo Linux Agent · Coming Soon See the Workbench