The things buyers actually ask.

Your Sentinel workspace stays in your tenant. We reach it through Azure Lighthouse with least-privilege roles that you grant and can revoke instantly; we never take a copy of your logs. The incident content needed to reason about a finding is sent to our language-model provider under commercial, zero-retention terms. The investigation reports and the audit trail are stored by Roxas Labs in the region set on your contract.

We use frontier models from Anthropic. Your data is not used to train any model; that’s contractual, with zero-retention on the provider side. If your agreements require a specific provider posture or region, tell us during onboarding.

Human-in-the-loop is the default. Every verdict is reviewable in the console with its full reasoning and evidence. Response actions are gated by approval unless you explicitly move a low-risk action to auto. Tuning rules let you suppress known-benign patterns so the same false positive doesn’t recur. And because everything is on the audit chain, a wrong call is inspectable after the fact, not lost.

The audit chain. Most tools give you a dashboard and ask you to trust it. Roxas Labs produces a hash-chained, signed, append-only record of every step, plus an offline verification bundle your auditor runs with no access to our systems, plus a framework-mapped attestation report. When you’re asked to show what was done, by an auditor, a regulator, or the board, that’s the difference between “we automated triage” and “here’s proof of what was done.”

Both, as two services. Managed Investigation reads, triages, classifies and comments; nothing changes state outside Sentinel. Managed Investigation & Response adds governed containment: isolate host, disable or reset an account, trigger an AV scan, block an indicator. Response actions run through playbooks pre-deployed in your own tenant, and an autonomy setting controls how much human approval each action needs.

Microsoft Sentinel is live today. Google Chronicle/SecOps and CrowdStrike Next-Gen SIEM are available on request: the investigation, approval and signed audit layers are not tied to one platform, so a new SIEM is a connector and a calibration pass, not a rebuild. If you run something else, tell us. We’ll say plainly whether we can support it and how long it would take.

Once you’ve granted the scoped Lighthouse access, we’re typically live in under an hour: connect your Sentinel workspace, set the engagement tier and severity threshold, and add your team over SSO. No new agents in your environment.

Scaled to your incident volume, with the service (Managed Investigation vs Managed Investigation & Response) as the main lever. Tell us a rough monthly incident count and we’ll give you a real number. Because it tracks incident volume rather than seats or endpoints, it moves with something you can already forecast. We agree the scope up front, so there are no surprises.

In the console, and, when it matches the criteria you set (verdict, severity), by email straight to your SOC distribution list, once per incident. Your team doesn’t have to sit watching a dashboard for the one that matters.

SOC 2 readiness is underway. Azure and our model provider are independently audited sub-processors that we list in the DPA. The verifiable audit chain is itself designed to make control-operation evidence something you can produce on demand rather than reconstruct.