The Sentinel system is responsible for receiving events from the Collector Manager. The events are then displayed in real-time and logged into a database for historical analysis.
At a high level, the Sentinel system uses a relational database and is comprised of Sentinel processes and a reporting engine. The system accepts events from the Collector manager as its input. The Collector manager interfaces with third-party products and normalizes the data from these products. The normalized data is then sent to the Sentinel processes and database.
Historical analysis and reporting can be done using Sentinel's integrated reporting engine. The reporting engine extracts data from the database and integrates the report displays into the Sentinel Control Center using HTML documents over an HTTP connection.