The Illuminate AI Portal is Sentinel's unified platform for AI-assisted sales, security, and operations intelligence. All features live behind Microsoft Entra ID (Azure AD) single sign-on — no separate passwords required.

Signing In

1. Navigate to the portal URL (e.g. https://illuminate.sentinel.com).
2. Click Sign-In. You will be redirected to Microsoft's login page.
3. Authenticate with your Sentinel corporate account (MFA if required).
4. You are redirected back to the portal, which sets a server-side session cookie. This cookie is used for all subsequent API calls — you do not need to sign in again during the session.

Navigation

After sign-in you land on the Sentinel Hub page (Sentinel.html). Use the card grid to navigate to each tool. The sidebar (where present) lets you switch between tool sub-views. Most tools require your Sentinel role to be set in the system — contact your admin if a card is greyed out.

Environment Banners

Customer Intelligence (also called Sales Notify) continuously monitors your customer accounts for signals that indicate risk, opportunity, or required action — then surfaces those signals as prioritized alerts in the dashboard.

What It Does

• Monitors contract renewal dates, support expiry, device end-of-life, and security advisories.
• Pulls in Cisco EoX / PSIRT data correlated against each customer's installed base.
• Runs nightly AI scoring to rank accounts by urgency and revenue impact.
• Sends email / Teams notifications to the assigned account manager when a threshold is crossed.

The AI Pipeline

Using the Dashboard

1. Select Customer Intelligence from the Hub.
2. Use the Account filter or search box to narrow to a specific customer.
3. Alerts are colour-coded: High (immediate action), Medium (within 30 days), Low (informational).
4. Click an alert row to expand the AI-generated summary and recommended next steps.
5. Click Export to download the current filtered view as CSV.

Understanding the Feed Intelligence

The Feed Intelligence panel (bottom of the dashboard) shows the raw signals that contributed to each alert: PSIRT advisories, renewal dates within 90 days, EoX milestones, and open support cases. Each signal includes its data source and last-updated timestamp.

Alert Severity Definitions

The Sentinel ChatBot lets you ask questions about your customer data, Sentinel products, Cisco lifecycle information, and internal knowledge — all through natural language. No special query syntax required.

How to Use

1. Open ChatBot from the Hub or sidebar.
2. Type your question in the chat box and press Enter or click Send.
3. The assistant streams the response in real time. Sources cited in the answer are clickable.
4. Use the conversation history to ask follow-up questions — the bot retains context within a session.
5. Click New Chat to start a fresh conversation (clears context).

Good Questions to Ask

• "Which customers have Cisco ASA devices reaching end of support in the next 90 days?"
• "Summarize open PSIRT advisories for Catalyst 9300 switches."
• "What are our renewal opportunities in the healthcare vertical this quarter?"
• "Draft a customer-facing summary of CVE-2024-XXXXX."
• "What Sentinel services cover network segmentation?"
• "Show me lessons learned from past firewall migration projects."

Scope and Limits

How It Searches Data

The ChatBot uses a Retrieval-Augmented Generation (RAG) architecture. Your question is converted to an embedding vector, matched against a pre-built index of your data, and the top relevant chunks are passed to Azure OpenAI alongside your question. The model generates an answer grounded in those chunks — it does not hallucinate data that isn't in the index.

The Reports module provides pre-built and on-demand reports across accounts, renewals, security posture, and pipeline intelligence.

Available Reports

Exporting Reports

• Most reports support CSV export for data manipulation in Excel.
• Account Health and PSIRT reports also offer PDF export for customer delivery.
• Use the Date Range filter before exporting to scope the data.

How to Read the Reports

All reports use traffic-light colouring: Red = critical / expired, Yellow = warning / approaching, Green = healthy. Column headers are sortable — click to sort ascending/descending.

The SIEM Validator reviews a customer's SIEM configuration, log-source inventory, and detection rules against best-practice benchmarks and known-gap patterns, then generates a prioritised remediation report.

What It Validates

• Log-source coverage (are all critical asset categories sending logs?)
• Detection rule quality (duplicates, disabled rules, low-fidelity alerts)
• Retention policy compliance (minimum 12 months for most frameworks)
• Alert tuning — false-positive suppression lists that may be too broad
• Integration health (data connectors showing as disconnected or delayed)

How to Use

1. Select the customer from the account picker.
2. Choose the SIEM platform (Microsoft Sentinel, Splunk, QRadar, etc.).
3. Upload or paste the configuration export / API credential (read-only).
4. Click Run Validation. The analysis typically takes 30–90 seconds.
5. Review findings grouped by severity. Expand each finding for AI-generated remediation steps.
6. Export as PDF for customer delivery or internal ticket creation.

Understanding Results

Each finding includes a Finding ID, affected component, severity, description, and recommended action. Findings marked Critical should be addressed before any compliance audit. The overall Coverage Score (0–100) reflects log-source completeness relative to the MITRE ATT&CK framework.

Cisco Intelligence aggregates Cisco's public lifecycle and security data — End-of-X (EoX) milestones, PSIRT advisories, and software release data — and maps it against each customer's installed base.

EoX Milestones

PSIRT Advisories

Cisco PSIRT (Product Security Incident Response Team) publishes security advisories for vulnerabilities in Cisco products. Each advisory is assigned a CVSS score (0–10). The portal colour-codes advisories as:

• Critical CVSS 9.0–10.0 — patch immediately.
• High CVSS 7.0–8.9 — patch within 30 days.
• Medium CVSS 4.0–6.9 — patch within 90 days.
• Low CVSS 0.1–3.9 — patch at next maintenance window.

Interpreting Results

The Affected Customers column shows how many accounts in your portfolio have at least one device running the vulnerable software version. Click a count to see the customer list with their device models and installed versions, helping you prioritise outreach.

The Solution Explorer helps you quickly identify which Sentinel products and services best fit a customer's use case, technology stack, or pain point — powered by AI-assisted product matching.

Finding Solutions

1. Enter a customer pain point or requirement in the free-text search box (e.g., "zero trust network access for remote workers").
2. Optionally select a Technology Category (Networking, Security, Collaboration, etc.) to narrow results.
3. Click Search. The AI ranks matching Sentinel offerings by relevance.
4. Review the top results. Each card shows the product name, brief description, and fit score.
5. Click a card to see full product details, datasheet links, and suggested next steps.

How Product Matching Works

Your query is embedded and compared against a vector index of the Sentinel product catalog (descriptions, use cases, technical specs). The top-K matches are re-ranked by Azure OpenAI using the full product descriptions to ensure semantic accuracy beyond simple keyword matching.

Keeping Results Current

The product catalog is re-indexed automatically when administrators update catalog entries in the admin panel. If a product appears missing, contact your portal admin to verify it is in the catalog.

The SOW Generator uses Azure OpenAI to draft a Statement of Work document from structured inputs, saving hours of manual writing while ensuring consistency with Sentinel's standard SOW template.

Required Inputs

• Customer name and primary contact
• Project type (e.g., network assessment, SIEM deployment, firewall migration)
• Scope description — free text describing what will be done
• In-scope / Out-of-scope items (you can add bullet points)
• Estimated duration and number of Sentinel resources
• Deliverables list (e.g., as-built documentation, test results, training)
• Assumptions and dependencies

Generating the SOW

1. Fill in all required fields on the SOW form.
2. Click Generate Draft. Azure OpenAI drafts the document (typically 20–40 seconds).
3. Review the generated text in the preview panel. Edit any section inline.
4. Click Download DOCX to export the document in Microsoft Word format.
5. The DOCX uses Sentinel's branded template with headers, footers, and logo.

Important Notes

The Lessons Learned repository captures post-project knowledge from completed Sentinel engagements, sourced from ServiceNow records. Use it to avoid repeating past mistakes and to find proven approaches for similar projects.

ServiceNow Integration

Lessons are automatically pulled from ServiceNow project closure records and enriched with AI-generated tags and summaries. Records sync nightly. The portal displays the structured lesson title, full description, project type, technology area, and contributing engineer.

Searching and Filtering

1. Use the keyword search to find lessons by technology, customer type, or issue description.
2. Filter by Project Type (e.g., Security, Networking, Collaboration) to scope results.
3. Filter by Date Range to find lessons from recent projects.
4. Sort by Relevance (AI-ranked) or Date (newest first).

Adding Lessons

New lessons are added through the standard ServiceNow project closure process. If you have a lesson that should be captured outside of a formal project closure, contact your project manager or use the Submit Lesson button (visible to SOC and Manager roles).

The Project Plan tool provides AI-assisted project planning for Sentinel engagements — from generating an initial work-breakdown structure (WBS) to tracking milestone progress.

Creating a Plan

1. Click New Project Plan and enter the project name, type, and target completion date.
2. Enter a brief scope description. The AI generates a suggested WBS with phases, tasks, and estimated durations.
3. Review and edit the generated tasks — add, remove, or re-order as needed.
4. Assign tasks to team members and set dependencies.
5. Save the plan. It is stored and accessible to all team members with access to the project.

How AI Assists with Planning

Azure OpenAI draws on Sentinel's historical project data (via Lessons Learned and internal templates) to generate realistic task lists, flag common risk areas, and suggest realistic durations based on past similar engagements.

Tracking Progress

• Mark tasks Complete, In Progress, or Blocked.
• The plan header shows overall percent complete and days remaining.
• Blocked tasks generate an automated notification to the project manager.
• Export the plan as an Excel workbook for sharing with customers.

All AI features in the Illuminate Portal are powered by Azure OpenAI Service — Microsoft's enterprise deployment of OpenAI models hosted in Sentinel's Azure tenant. No data leaves the tenant boundary.

Azure OpenAI Usage

How Prompts Drive Each Feature

How Risk Scores Are Calculated

Risk scores are a weighted composite:

• 40% — Security advisory severity (max CVSS across open advisories)
• 25% — EoX proximity (months until LDoS, scaled 0–100)
• 20% — Contract renewal urgency (days until expiry)
• 15% — Support case volume (open P1/P2 cases, last 90 days)

The AI is then asked to review this weighted score and adjust ±10 points based on qualitative context. The final adjusted score is what appears in dashboards.

AI Call Audit Log

Every request to Azure OpenAI is logged in the AI Calls tab (admin only) with: timestamp, feature, model, prompt tokens, completion tokens, latency (ms), and full prompt/response text. This enables cost tracking, quality auditing, and debugging.

Data Privacy

All Azure OpenAI calls are made within Sentinel's Azure subscription. Customer data sent in prompts is subject to Sentinel's data handling policies and Microsoft's enterprise data protection commitments. No data is used to train OpenAI models.

Access to features is controlled by your assigned role, which is set by a portal administrator. Roles map to Sentinel job functions.

Role Descriptions

Requesting a Role Change

Contact your portal administrator or raise a request via the standard IT helpdesk process, referencing "Illuminate Portal role change." Include your name, email, current role, and requested role with business justification.