High-value files
Unexpected root PHP, the WordPress root index, .htaccess, .user.ini, wp-config.php and critical drop-ins receive focused attention.
The correlation core behind Breach Command
One suspicious event is not enough. Sentinel looks for independent evidence.
Sentinel Engine powers Nexus Breach Command by correlating multiple compromise signals instead of escalating from one noisy file, one IP address or one isolated alert.
01ObserveCritical filesystem and runtime evidence.
02CorrelateIndependent evidence classes remain distinct.
03EscalateSupported thresholds create a real incident state.
04RespondBreach Command decides what happens next.
Critical Root Sentinel
Protect a deliberately small, high-value surface continuously.
Sentinel does not need to scan the whole world on every request to notice dangerous change where it matters most.
New executables
Newly observed executable artifacts can receive immediate bounded analysis without turning every pre-existing custom file into a breach.
Do not normalize compromise
First-run and post-maintenance critical-surface validation help prevent a pre-existing compromise from silently becoming trusted state.
Security controls matter too
Unexpected disappearance or tampering of security and audit controls can become part of the wider incident picture.
Maintenance-aware by design
Updates should not look like outbreaks.
Sentinel understands WordPress maintenance context. Plugin, theme and core updates can settle and be verified while high-confidence malicious evidence can still break through maintenance suppression.
- Post-update verification is scheduled shortly after maintenance completes
- Bulk updates collapse into one bounded verification cycle
- Expected activity can feed Observed Activity without ordinary alert noise
- High-confidence compromise indicators are never hidden by maintenance context
Sentinel principle
Correlation earns escalation.
Evidence remains independent until the incident model supports connecting it.
Powered by Sentinel
The engine watches. Breach Command explains and responds.
Sentinel Engine is the compromise-correlation core behind Nexus Breach Command and REDLINE.