One platform, endless possibilities
NetOps, SecOps and AppOps, connected and powered by AI.
The Infinity ecosystem
SentiNet³ is an innovative operational ecosystem for monitoring, designed to transform the management of IT infrastructure. It is a complete, strategic and entirely Italian solution and, since 2016, the only Italian system included in the Gartner Market Guide for IT Monitoring Tools. Its goal is to ensure efficiency, security and operational continuity in critical IT environments.
Thanks to its modular structure, SentiNet³ provides:
Customisation and scalability
Each module can be configured to meet specific monitoring needs, so the platform can be adapted to the requirements of different systems and scaled as needs grow.
Integration of specialist capabilities
Each component focuses on a key aspect, such as performance analysis, security, resource management or proactive monitoring.
Centralised operations
It offers a holistic view and centralised control, simplifying the management of complex environments and delivering greater efficiency.
Latest-generation technologies
It makes use of advanced tools such as generative artificial intelligence, automation and machine learning to provide predictive analysis and proactive actions.
Three operational domains, one correlation engine
Each Insight module specialises in a key area of the IT infrastructure. Around Sentinet³ Core, the central hub that monitors every asset, the modules work together through the Infinity Correlation Engine.
Network Insight · NetOps
Captures and analyses network traffic to monitor it and identify potential threats.
Discover Network InsightSecurity Insight · SecOps
Simplifies the work of SOC teams, speeding up event contextualisation and triage.
Discover Security InsightApplication Insight · AppOps
Oversees the entire flow of application requests, promptly detecting errors and slowdowns.
Discover Application InsightInfinity Correlation Engine
The engine that links the data of the Infinity modules: network, security and applications no longer remain separate pieces of information, but become a single, queryable body of knowledge.
AI Insight
Correlates all the data, generates answers in natural language and suggests actions.
Discover AI Insight
Network Insight
The Sentinet³ Network Operations module, designed to provide complete visibility of network traffic through advanced analysis of NetFlow data. With this tool you can monitor, analyse and optimise network performance, identifying anomalies, congestion and potential threats in real time.
- Identify performance issues and reduce fault resolution times.
- Optimise bandwidth usage and manage resources intelligently.
- Detect traffic anomalies that could indicate malicious activity.
- Prevent congestion and bottlenecks, improving operational efficiency.
- Provide detailed data for strategic capacity planning decisions.
Key features
The four areas in which Network Insight works on network flows: NetFlow analysis, anomaly detection, performance optimisation and dashboards with advanced filters for targeted traffic searches.
NetFlow analysis and monitoring
- Real-time capture and display of network flows.
- Traffic classification by protocol, IP, port and application.
- Identification of the most critical connections and suspicious communications.
Anomaly detection and network security
- Analysis of traffic behaviour with detection of anomalous patterns.
- Automatic identification of suspicious activity and unauthorised communications.
- Detailed traffic history for post-event investigations.
Network performance optimisation
- Latency measurement to identify bottlenecks.
- Control over bandwidth usage to avoid saturation and waste.
- Detailed reporting for tuning network policies.
Intuitive, customisable dashboards
- Interactive graphical display of network flows.
- Advanced filters for targeted traffic searches.
- Automated reports for analysing performance over time.
Application Insight
The Sentinet³ Application Monitoring module is designed to provide advanced application monitoring based on OpenTelemetry, the open standard for collecting metrics, logs and traces. With Application Insight, organisations gain a clear and detailed view of the performance of their applications, identifying bottlenecks, errors and anomalies in real time.
- Continuous application monitoring to spot problems before they affect users.
- Detailed performance analysis to reduce latency and optimise code.
- Automatic detection of errors and anomalies with real-time alerts.
- Correlation between metrics and logs for faster problem resolution.
- Adaptable to any technology stack thanks to OpenTelemetry.
Key features
Metrics, logs and traces collected with OpenTelemetry become real-time monitoring, error management, performance optimisation and customisable dashboards.
Real-time monitoring
- Advanced collection of metrics, logs and traces for a complete view of applications.
- Identification of slow response times and the most critical requests.
- Display of the entire application execution chain (distributed tracing).
Anomaly detection and error management
- Automatic detection of application errors and malfunctions.
- Analysis of application behaviour to detect anomalous changes in load.
- Smart notifications for immediate alerts on system issues.
Performance optimisation
- Analysis of resource usage to reduce waste of CPU, RAM and storage.
- Correlation between response times, errors and system metrics to identify problems quickly.
- Support for microservices, containers and cloud-native architectures.
Intuitive, customisable dashboards
- Interactive graphical interface with views of metrics, logs and traces.
- Advanced filters to segment traffic and requests by application, service or user.
- Automated reporting for detailed analysis of performance over time.
Security Insight
Security Insight helps first-level SOC analysts quickly understand whether a security event involves strategic assets, providing a clear, contextual picture that speeds up and simplifies triage. It accelerates advanced analysis and operational response for second- and third-level SOC analysts.
- Identify suspicious applications and processes, including fileless executions (PowerShell and svchost processes).
- Monitor the installation of new software and changes to the attack surface.
- Monitor users with elevated privileges to detect suspicious privilege escalation.
- Correlate system events with network activity to detect advanced attacks.
- Check system configurations and critical files to detect suspicious changes.
Support for every SOC level
At level 1 Security Insight provides rapid triage and visibility of strategic assets; at levels 2 and 3 it speeds up advanced analysis and operational response.
Level 1: rapid triage and strategic visibility
Advanced host monitoring
- Immediate identification of the operating system (Windows, Linux, macOS).
- Quick view of CPU and RAM usage and active services.
- Detection of new listening ports to identify unauthorised services.
Levels 2 and 3: advanced analysis and operational response
Automated event analysis
- Rapid identification of newly started processes and Kernel/User classification.
- Detailed monitoring of disk and network activity to detect anomalous behaviour.
- Analysis of external connections to identify suspicious communications with Command & Control (C2) servers.
- Automatic checking of changes to critical configuration files.
Threat detection and event correlation
- Automatic detection of fileless processes and suspicious in-memory activity.
- Checking of connections to unknown or suspicious IPs.
- Monitoring of users with elevated privileges to detect unauthorised escalation.
- Analysis of repeated failed login attempts (possible brute-force attacks).
Key features
From host and operating system monitoring to forensic analysis: the capabilities that support the SOC from detection to response.
Advanced host and OS monitoring
- Identification of the operating system (Windows, Linux, macOS) and collection of specific data.
- Monitoring of CPU, RAM, active processes, disk usage and running services.
- Checking of system configurations and critical files to detect suspicious changes.
Threat detection and event correlation
- Detection of fileless processes and suspicious in-memory activity.
- Checking of connections to unknown or suspicious IPs.
- Correlation of SIEM alerts with host status and service maps.
Automated security event analysis
- Identification of new processes started in the last 30 days.
- Verification of changes to critical configuration files, such as /etc/passwd or the Windows registry.
- Detection of new listening ports to identify unauthorised services.
- Monitoring of active connections to external hosts, to identify suspicious communications with Command & Control (C2) servers.
Intuitive dashboards and advanced forensic analysis
- Graphical display of security events with interactive timelines.
- Advanced filters for suspicious events, with the ability to correlate multiple data sources.
- Detailed reporting on host status, installed software and detected anomalies.
Cybersecurity Situational Awareness
The ability to perceive the security status of the infrastructure clearly and quickly, so you can act promptly and effectively against threats. In a single view the operator finds:
- VLAN segmentation, by priority level and network type;
- immediate indicators of compromise or anomaly, such as security alerts, lateral movement attempts, privilege escalation, port scans and anomalous logins;
- the criticality and real-time operational status of the key components of the infrastructure;
- natural language queries through AI Insight, for immediate answers on security status.
Immediate perception
A single picture shows the security status of the different areas of the network and quickly flags problems or anomalies with colour-coded status indicators.
Understanding and analysis
You can see at a glance which resources are involved, how severe the events are and which areas are critical, for targeted and immediate action.
Projection and response
Analysts quickly identify emerging threats and the critical points to watch, and trigger corrective and preventive actions in good time.
Security integrations and Cyber Situational Awareness maps. Sentinet³ interfaces with SIEMs, EDR/XDR systems, DDoS mitigation, next-generation firewalls and AD, LDAP and IAM systems through standard APIs or native connectors, and correlates events with the infrastructure topology. Infrastructure, topological and functional maps highlight the elements under attack with the CVEs detected and the MITRE ATT&CK techniques, with drill-down down to the indicators of compromise. For distributed environments: Federated Cyber Situational Awareness.
Threat Insight
The module combines continuous Vulnerability Assessment, exposure assessment, attack path analysis and mitigation priorities. From the list of CVEs to the action plan: which systems, along which paths, threaten the most critical assets, and which remediations deliver the greatest benefit.
- Continuous Vulnerability Assessment to identify critical vulnerabilities in systems.
- Critical entry points: dynamic ranking of the most exposed nodes, based on the actual state of the network.
- Attack paths on interactive maps, showing how an attacker would move from the outside in.
- Simulation of lateral movement and blast radius starting from any node.
- Posture measured in real time: Global Risk Score from 0 to 100, continuously updated, with historical trend.
Key features
Four capabilities that take you from a list of CVEs to an action plan: Continuous Vulnerability Assessment, operational priority, attack paths and continuous risk measurement.
Continuous Vulnerability Assessment
- Lightweight agent on the host, with no need to systematically schedule active scans.
- SBOM associated with each asset and continuous comparison with CVEs.
- Integration of results from third-party VA scans.
From severity to operational priority
- CVSS score read together with exposure and infrastructure relationships.
- “Application oriented” view: from applications to libraries and related CVEs.
- Remediation priorities that better reflect the context.
Attack paths and lateral movement
- Entry points, propagation and backtracking towards critical assets.
- Correlation of topology, NetFlow flows, privileges, firewall rules and shares.
- Chokepoints and mitigation strategies with the greatest benefit.
Continuous Cyber Risk Assessment
- Asset Risk Index for each individual asset.
- Path Risk Score for possible attack paths.
- Global Risk Score and Risk Dashboard for the infrastructure as a whole.
AI Insight
The Sentinet³ intelligent analysis and correlation module, designed to enable advanced natural language queries on all company data, from monitoring, security, network and applications.
Correlates all the data, generates answers in natural language and suggests actions.
Thanks to a highly specialised SLM (Small Language Model), optimised to run entirely on premises, AI Insight delivers immediate, contextualised answers while ensuring maximum privacy and confidentiality.
Discover AI Insight
Ask your data, in natural language
Organisations collect huge volumes of data on performance, security and the network, but extracting critical information quickly and effectively is a challenge. AI Insight removes this complexity, providing clear answers in seconds to questions such as:
- Which processes are currently running on IP 192.168.23.4?
- Which services have had the most problems on that IP in the last 24 hours?
- When did service x last work correctly?
- Which users changed the status of service x?
- Which users logged in between 18:00 and 05:00 on that IP?
- Has the software installed on that IP changed in the last month?
Want to see Sentinet³ on your infrastructure?
Tell us about your environment: sites, technologies, critical services. We will show you how Core and Infinity can work on your case.