ThreatSentry is designed to protect servers running Microsoft Internet Information Services (IIS). It is an advanced neural application that continuously collects, analyzes, and organizes server events into an evolving baseline of acceptable activity. Each server connection is compared against this baseline to identify and take action against any activity falling outside of acceptable parameters.

Upon installation, ThreatSentry begins to collect and organize IIS-specific data into clusters that reflect the normal use patterns within the server environment, ("Training Mode"). The process of organizing these clusters is guided through the use of a built-in knowledgebase of published attack signatures.