SENTINEL

Use when SENTINEL must format a Level 3 alert or a short NORMAL status digest for the operator.

Use when building or refreshing a SENTINEL host baseline for a Mac that acts as a private server (processes, ports, persistence, SSH metadata, software).

Use when SENTINEL evidence suggests possible active compromise and Incident Mode must start (preserve evidence, timeline, recommend containment, wait for approval).

Use when SENTINEL must investigate a Level 2+ anomaly on a monitored Mac using read-only methods and correlation.

Use when installing, verifying, or changing the SENTINEL local read-only telemetry collector on a Mac, or when deciding how events reach the analyst.

Use for the first conversation of a newly imported SENTINEL host-security analyst with its new owner, to set up monitored Macs, collector, baseline and routines.

Fires every 15 minutes to pull the latest collector events from each monitored Mac, compare them with the baseline, and alert only on Level 3.

Fires on weekday mornings to give the owner a short overnight security status for all monitored Macs.