Verified product benchmark
Three confirmed product outcomes. Every number is tied to a frozen baseline, raw counts, a published formula and an automated reproduction test.
Confirmed results
Sentinel identified 18 of 20 labelled attack scenarios, compared with 10 for the frozen fixed-signature baseline.
Recalculated from the frozen, expected-malicious scenario manifest; scenario IDs and detector mappings are asserted by the automated suite.
Sentinel consolidated 100 related alerts into 40 incident groups by target and time window.
Executed through Sentinel’s production clusterAlerts/triageAlerts path using frozen alert, target, tenant and timestamp fixtures.
Sentinel automatically routed 45 of 100 independent incidents that cleared both the critical-risk and high-confidence thresholds.
Executed through Sentinel’s production incident scoring and routing path; both score ≥85 and confidence ≥0.85 are required.
Verification protocol
A result is marked verified when HLD Group’s automated benchmark reproduces it from the frozen comparison inputs and matches every raw count and formula shown on this page.
Corpus, expected labels, baseline behaviour, thresholds and calculation rules are fixed before execution.
The baseline and Sentinel receive the same controlled inputs. No result is normalised or selectively removed after the run.
Automated tests assert the numerator, denominator, production-path result and published percentage together.
A claim remains verified only while the benchmark repeats exactly against the named corpus version.
External comparison framework
We use public, vendor-neutral references to define the control, classify the attack behaviours and keep the scoring consistent. Sentinel and the control receive the same inputs; only the detection and triage capabilities differ.
The control is limited to fixed signatures and indicators, following Sigma’s vendor-neutral rule structure and severity conventions. Behavioural baselining and cross-source correlation are disabled. This isolates the additional coverage produced by Sentinel’s multi-layer engine.
Sigma Specification 2.1.0Each eligible scenario is classified by adversary behaviour using MITRE ATT&CK Enterprise. Scenarios are counted once, even when multiple detectors fire, preventing duplicate alerts from inflating coverage. The same relevant technique set is used for both sides.
MITRE ATT&CK Enterprise v19Detection, analysis and routing are measured as separate outcomes. Following NIST incident-response guidance, we publish the raw event, incident and decision counts rather than combining them into a proprietary score.
NIST SP 800-61r3Detection corpus
The coverage test compares a fixed-signature rules baseline with Sentinel’s combined signature, behavioural and correlation layers. A scenario counts once when at least one mapped detector produces the expected detection.
Run a scoped evaluation with the baseline and acceptance criteria agreed in advance.