Knowledge base
297 articles. Real procedures with the real error messages in them, and the limits stated where there are limits. If an article tells you a change will break something, it names what.
Start with what the product actually does and does not do, then connect Microsoft 365 and read your own report.
What Qorionix does
An alert arrived, or Sentinel-Q acted on its own, and you need to know what to do in the next ten minutes.
What to do when an alert arrives
An auditor, an insurer or your largest customer has asked for evidence. Produce it in two clicks.
The evidence bundle
What Qorionix does, how to set up your organisation, and what to do in your first week.
The consent flow, every permission we ask for and why, and what happens in the first hour.
How to read a finding, how changes are grouped into done, approve and decide, and how to undo one.
Users, groups and roles; single sign-on, passkeys and adaptive MFA; network zones, session policies and provisioning.
The credential vault, rotation, proxied and recorded SSH and RDP sessions, just-in-time elevation, approvals and break-glass.
Connecting log sources, how events are normalised, the detection library, tuning a rule, search, dashboards and retention.
Deploying the sensor, enrolment, behavioural detections, incidents and process trees, threat hunting and response actions.
What the AI is allowed to do, how to read a decision, and how to agree, disagree or escalate.
What an alert means, what to do first when you have no security team, and why some detections stay quiet.
The connector catalog, configuring and testing a connector, outbound webhooks and their signatures, and where alerts get delivered.
The evidence bundle, NIS2 duties, GDPR requests, the EU AI Act, and how findings map to DORA and ISO 27001.
Real symptoms with real causes, written around the error message you actually saw: enrolment, rotation, ingest, sign-in, webhooks and seats.
Roles and permissions, plans and entitlements, seats, retention, notification preferences, support access, and how to get help.
Sentinel-Q decisions
Why an operator typing "eu" into a box does not make inference EU-resident: the four provenance levels, what counts as evidence, and the endpoints that are refused.
Alerts and response
One approval that ends sessions, isolates devices and suspends accounts across Qorionix and Microsoft 365, previewed first, undoable where possible.
Alerts and response
How staff report a suspicious click in ten seconds, what Sentinel-Q checks, what the owner's report card recommends, and how to hide the button.
Account and administration
The settings that belong to the organisation rather than to a person, what a home region actually guarantees, and the one exception we refuse to paper over.