Questions, including the awkward ones

Does Sentinel diagnose the outage?

No. It suggests from history and does not diagnose. It shows an earlier incident that looks similar, the terms the two share, and the action item a person wrote when it was resolved. It never states a cause.

What does Sentinel do when nothing in my history is similar?

It says nothing is similar. A suggestion appears only when a stored prior incident clears both a rank score of 0.05 and at least three distinct shared terms. A new workspace sees no suggestions for weeks, which is correct rather than broken.

Can Sentinel show a match that does not exist?

No. Every match row must point at a stored prior incident by a non-null foreign key, and the page refuses to render a suggestion whose cited incident is not in the workspace. Matches come from full-text search over your own incidents, not from a model.

Where is a language model involved?

Only after search has already linked two incidents, and only to write one sentence about what the two records have in common. That sentence is checked outside the model call: any number or substantive word not present in the two records, any statement of cause, and any recommendation cause it to be dropped, and the match is shown with its shared terms and no prose.

Does Sentinel close an incident when my alerting tool says it recovered?

Yes, under a strict rule. A resolved or OK notification is never stored as an alert. It is matched to an open incident by identical fingerprint, and the card closes only when every distinct check on it has cleared after its own last alert — one recovery does not close a six-alert storm card. A closed card has no action item, so it is not in the match library until someone writes one.

How do alerts get into Sentinel?

Two ways. Each workspace gets a webhook URL that accepts POSTs — Prometheus Alertmanager and Grafana work without adapting anything, and any JSON with a summary, title or message field is read. It also gets a forwarding email address, for tools that can only send mail. One Alertmanager POST carrying forty alerts becomes one incident card, by the same grouping rule.

What does Sentinel cost?

Nothing today. There is no card form and no paid plan. There is a waitlist.

Is this Microsoft Sentinel?

No. Sentinel by Deplyra is an on-call incident copilot. Microsoft Sentinel is a security-operations product from Microsoft. They are unrelated.

What data does Sentinel hold?

The alert emails you forward, stored as they arrived, plus the incidents and action items you write. It has no access to your infrastructure, your telemetry or your source code, and there is no shared corpus across customers.