Platform · 05 Investigate
Start from a flagged event, an analyst concern or a customer report. SENTR brings the related activity, decision evidence and case work together—so your team spends time investigating, not assembling the story.
Connected intelligence
An event can look ordinary until you see the same device, session or instrument in other activity. Rebuilding those relationships manually slows every investigation.
SENTR resolves five profile families: users/accounts, devices, sessions, IPs and payment methods. Each brings together activity, risk indicators, alerts, open cases and linked profiles from the identifiers you supply.
Enlarge view A payment event and its linked device and instrument in Connection Ring. A connection is an investigation lead, not a verdict.
Inspect the relationship and keep the underlying event in view.
Turn a suspicious connection into an investigation with context. Shared identifiers are leads—not proof of collusion or guilt.
Investigation operations
An undifferentiated alert inbox hides urgent work, repeats context gathering and leaves closed cases with conclusions nobody can compare.
Cases can start from a policy, an analyst or an external report. Group the source reference, subjects, linked activities and evidence in one workspace, then route the work through queues your team can operate.
Enlarge view Configure queue routing by fraud category, risk score and priority.
Direct the right work to the right queue instead of treating every alert alike.
Make experienced judgement reusable and review work inspectable. Case closure records an operational outcome; it does not settle a financial dispute.
Detection in one vendor, cases in another, and entity linkage in a warehouse extract turns every serious review into a mini-project. Rings and mule patterns thrive in that gap—analysts find the cluster after loss, or after a partner escalation nobody owned.
Investigation depth depends on identifiers and history from Data & integrations. SENTR.Citadel is where operators work that depth; SENTR.Tower uses a simpler guided view—see SENTR.Tower versus SENTR.Citadel.
An event enters review with connected account, device and payment context. An investigator examines those relationships and collects evidence in the case before recording an outcome. A shared identifier is a lead, not proof of fraud. The diagram is a workflow illustration, not a product screenshot.
A review item should already carry the decision reason and the linked entities worth inspecting — before anyone rebuilds the ring in a spreadsheet.
From queue to outcome
See the event and which rules, lists or policy bands put it in queue—not a bare alert ID.
Account, device, payment instrument or beneficiary history from the identifiers you mapped.
Related entities and activity stay attached so rings are not rebuilt in a spreadsheet.
Attach evidence, decide, record a written reason when you override, and leave the outcome on the decision record.
Illustrative workflow
A payout review opens with beneficiary-reuse contribution. Entity history shows a new account. Connection Ring surfaces two other merchants sharing the same payout destination and overlapping devices.
Portfolio risk is visible without a custom BI pull for every incident.
Outcomes feed the improvement loop in Workflows & human feedback.
Keep the work connected
Put the outcome to work in reports, controls and eligible model feedback.
Continue to ImproveSENTR.Tower includes case work with a simpler review experience. SENTR.Citadel gives your team deeper control of queues, checklists and workflows.
Compare the exact controls ↗Follow an event into its connected activity, evidence and recorded outcome. Ask for a walkthrough focused on the cases your team needs to resolve.