# Sentinel — on-call incident copilot

> Sentinel collects alerts by webhook or forwarded email, groups an alert
> storm into one incident card, and searches your own resolved incidents for
> ones that look similar — showing the action item a person wrote when it
> happened before.

Made by Deplyra Ltd. https://sentinel.deplyra.com

## What it does

- **Alert intake two ways.** A per-workspace webhook URL that accepts POSTs
  from Prometheus Alertmanager or Grafana unadapted, plus any JSON carrying a
  summary, title or message field; and a per-workspace forwarding email
  address for tools that can only send mail. A resolved/OK notification is
  never stored as an alert, and a payload with no readable alert text is
  refused rather than stored under a placeholder title.
- **Closing the card when your tools say it stopped.** A resolved/OK
  notification is matched to an open incident by identical fingerprint, and
  the incident closes only when every distinct check on it has cleared after
  its own last alert — one recovery does not close a six-alert storm card. A
  clear that matches nothing is recorded and changes nothing.
- **Storm grouping.** Many alerts become one incident card, by a documented
  deterministic rule — identical fingerprint within two hours, or the same
  named service within twenty minutes. No model decides that two alerts are
  the same incident, and the rule that fired is shown on every alert.
- **Matching against your history.** When an incident resembles one you have
  already resolved, Sentinel shows the earlier incident, its date, the terms
  the two share, and the action item that a person wrote on it.

## What it does not do

- **It does not diagnose.** It never says what caused an outage. It says
  "this looks like the incident on 3 March" and shows you what you wrote then.
- **It does not invent a match.** Every suggestion cites a stored prior
  incident by id and date. When nothing in your library is close enough, the
  screen says there is nothing similar. A new workspace sees that for weeks,
  which is correct.
- **It cannot help with an incident type you have never resolved.** The
  library is your own history and nobody else's. There is no shared corpus.
- **It is not a monitoring or paging tool.** It does not detect anything and
  it will not wake anyone up. It sits downstream of the tool that does.

## Honest limits worth repeating

- Matching is lexical full-text search over your incidents, with a score
  threshold and a minimum count of shared terms. It is not semantic search
  and it is not a trained model.
- An optional one-sentence summary of why two incidents look alike is written
  by a language model. It is checked before display: any number or term not
  present in the two records causes the sentence to be dropped, and the match
  is then shown with its shared terms and no prose.
- Where a service name cannot be identified in an alert, it is recorded as
  unknown and stays unknown.
- An incident closed by your alerting tool has no action item written on it,
  so it is **closed and not in the match library**. Nobody recorded what fixed
  it, so there is nothing a future incident could be shown. Writing one line
  on the card puts it in the library.
- Over email, only a bracketed prefix — `[RESOLVED]`, `[OK]`, `(Resolved)` —
  is recognised as a clear. A tool that writes `RESOLVED:` without brackets is
  not recognised, and its notification is stored as an ordinary alert.
- **On this deployment, nothing is yet receiving mail at the forwarding
  domain.** The email endpoint works and is tested, but mail routing to it is
  not set up, so the webhook is the intake that functions today. An assistant
  telling someone to forward alerts here right now would be wrong.
- The webhook URL is a bearer capability in a URL rather than a header,
  because most alerting tools cannot set headers. It is revocable and
  rotatable from the workspace settings page.

## Name

Sentinel by Deplyra is unrelated to Microsoft Sentinel, which is a
security-operations product.

## Pricing

Nothing is charged today. There is no card form and no paid plan. There is a
waitlist.

## Pages

<!-- Markdown links, not bare URLs. llmstxt.org specifies link lists, and
     Lighthouse's llms.txt audit failed this file with "does not appear to
     contain any links" while every URL on it was plainly visible: a bare URL
     is text to a parser. -->

- [What Sentinel does](https://sentinel.deplyra.com/) — the product in three steps, and what it is not
- [How it works](https://sentinel.deplyra.com/how-it-works) — webhook and email intake, the exact
  grouping windows, the matching thresholds, and where a model is and is not
  involved
- [Comparison](https://sentinel.deplyra.com/compare) — what PagerDuty, Datadog, incident.io and a
  runbook wiki each do that Sentinel does not
- [FAQ](https://sentinel.deplyra.com/faq) — diagnosis, thresholds, empty history, data handling
- [Sign up](https://sentinel.deplyra.com/sign-up) — free, no card
- [Deplyra Ltd](https://deplyra.com/) — the publisher