THEO surfaces proactive insights across your CRM, PSA, and security data without you having to ask. The Sentinel engine runs analysis on a schedule, detects anomalies and risks, and posts findings to your portal so your team can act before issues escalate. This article explains what Sentinel insights are, where they appear, and how to work with them.
What Sentinel Insights Are
Sentinel insights are THEO-generated observations about your environment that fall outside normal patterns. They are not responses to questions you asked — they are findings THEO discovered on its own by comparing current data against historical baselines.
Each insight has:
- Severity — the urgency level of the finding
- Category — the area affected (tickets, devices, incidents, billing, security)
- Title and summary — a plain-language description of what was found
- Recommendation — what THEO suggests you do about it
- Evidence — the underlying data that triggered the finding
- Entity links — the specific clients, devices, tickets, or contacts involved
What THEO Monitors
Sentinel tracks daily snapshots of:
- Open ticket count and critical ticket count
- Device alert count
- Active incident count
- Overdue invoice count
- Average ticket age in hours
Anomalies are flagged when current values deviate significantly from the rolling baseline for your org.
Where Insights Appear
Active Sentinel insights appear in:
- The portal dashboard — a dedicated Sentinel insights panel
- THEO chat — you can ask "What are my active Sentinel insights?" and THEO summarizes them
- Daily briefs — morning summaries that include the highest-priority insights
Types of Insights
Ticket anomalies — unusual spikes in open tickets, critical tickets that have aged beyond your normal response window, or clusters of tickets from the same client that may indicate a larger underlying issue.
Device anomalies — sudden increases in device alerts, devices that have stopped checking in, or patterns suggesting a configuration drift.
Security anomalies — increases in active incidents, correlated alerts across multiple clients, or indicators that may precede a broader incident.
Billing anomalies — overdue invoices that have crossed thresholds, unusual billing patterns for a client.
Working With an Insight
Viewing Insight Detail
From the portal dashboard, click any Sentinel insight to see the full summary, evidence, and recommended action.
You can also ask THEO directly: "Tell me more about the ticket volume anomaly for Northwind."
Acknowledging an Insight
Once you have reviewed an insight and taken action (or decided no action is needed), acknowledge it:
- Open the insight
- Click Acknowledge
- THEO marks it as reviewed and removes it from your active list
Acknowledged insights are retained in history so you can refer back to them.
Forcing a Sentinel Analysis Run
If you want Sentinel to run immediately rather than waiting for the next scheduled cycle, you can trigger it from the portal or ask THEO:
"Run a Sentinel analysis now."
This is useful after a significant event — a security incident, a client migration, a large batch of new devices — when you want updated insights before the next scheduled run.
Insights in the Context of Other Products
CRM context — Sentinel can surface churn risk signals based on ticket patterns, open incident history, and billing irregularities for a client. These appear as insights tagged to the client entity.
PSA context — Ticket age anomalies and unassigned ticket spikes are surfaced as PSA-category insights, helping you catch SLA risk before clients escalate.
Security context — ARGUS feeds incident and alert data into the Sentinel snapshot cycle, so security anomalies appear in the same insights feed as operational ones.
FAQ
How often does Sentinel run?
Sentinel runs on a scheduled cycle and captures daily snapshots of the key metrics. You can trigger an ad hoc run at any time from the portal or via chat.
Can I configure what thresholds trigger an insight?
Sentinel uses baselines derived from your own historical data. Custom threshold configuration is not exposed as a user setting at this time.
Do insights auto-resolve?
Yes. Insights have an expiry and an auto-resolve flag. If the underlying condition clears — for example, the ticket backlog returns to normal — THEO marks the insight as auto-resolved.