Sentry-1 and Sentry-TRM

Caliptra is not a single model with a marketing name. It is a path: ingest, first-pass, deep investigation, case writing, and a human gate before anything risky runs. Two named pieces sit on that path, Sentry-TRM and Sentry-1, and they are intentionally different jobs.

Sentry-TRM: the first pass

Sentry-TRM is the fast recursive first-pass. Its job is not to write a novel about every alert. Its job is to land a typed verdict quickly enough that obvious noise never reaches the deep pass.

That distinction matters. A first-pass that tries to “fully investigate” everything will either be slow, or it will invent confidence it does not have. Sentry-TRM is scoped to clear what can be cleared with the evidence already in hand, and to escalate what cannot. The output is structured: a verdict shape the rest of the system can trust as an input, not a free-form chat reply that someone has to reinterpret.

When Sentry-TRM clears noise, it is not claiming omniscience. It is enforcing a product rule: do not spend scarce human attention on rows that the first-pass can responsibly dismiss.

Sentry-1: reasoning on what remains

Sentry-1 is the purpose-built SOC reasoning model. It takes the ambiguous and serious remainder (the cases that survived the first pass) and investigates with tools, context, and plain-language judgment.

Where Sentry-TRM is about typed speed, Sentry-1 is about narrative and next steps. It is trained for the shape of SOC work: verdicts you can act on, evidence trails you can audit, and recommendations that a human can accept, reject, or amend. It is not a generic chatbot dropped on a ticket queue. It is a reasoning layer that knows the case is the unit of work.

Importantly, Sentry-1 does not get a blank check. Risky actions still wait for a person. The model can prepare; it does not silently become the approver.

One evidence spine

Both pieces sit on the same evidence spine. Raw and enriched data live in object storage so Cases and Analysis are not two different truths. A verdict from the first-pass and a deeper write-up from Sentry-1 should be able to point at the same underlying objects. Follow-up questions in Analysis should read the same store the verdict used.

That is how you avoid the classic split: an auto-close that nobody can explain, or an investigation note that cannot be tied back to the original fields.

What each is not

Sentry-TRM is not “the small model that does everything cheaply.” It is the model that is allowed to move early because its job is narrow.

Sentry-1 is not “the big model that finally replaces the analyst.” It is the model that investigates and writes so the analyst’s attention lands on judgment, not archaeology.

Together they implement a simple path we describe on the site: clear the noise, investigate what matters, and keep a human on every risky action. No invented percentages required, just a clear division of labor on the way from ingest to approval.