SentinelX is a cybersecurity monitoring and detection platform designed to simulate a Security Operations Center (SOC) workflow.
It collects security events from log files, analyzes them, detects suspicious activity, calculates risk scores, stores alerts, and provides an interactive dashboard for security investigation and incident response.
- 🔍 Security log collection and parsing
- 🚨 Brute-force attack detection
- 🌐 Port-scan detection
- 🔐 Suspicious administrator login detection
- 🧱 Firewall-block detection
- 🔗 Authentication attack-chain correlation
- 🎯 Risk scoring from 0–100
- 🧠 AI-assisted security investigation
- 🚑 Automated incident-response recommendations
- 📊 SOC dashboard
- 🗄️ SQLite alert persistence
- 🔎 Alert search and severity filtering
- 📈 Attack activity analytics
- 📋 Incident history
- 🧪 Automated testing with Pytest
Security Logs ↓ Log Collection ↓ Log Parsing ↓ Event Normalization ↓ Detection Engine ↓ Event Correlation ↓ Risk Engine ↓ Security Alerts ↓ AI Investigation ↓ Incident Response ↓ SOC Dashboard ↓ Incident History
Detects repeated failed SSH login attempts from the same source IP.
Detects repeated connection attempts from the same source IP across multiple ports.
Detects successful authentication involving an administrator account.
Detects suspicious connections blocked by a firewall.
Correlates multiple failed authentication attempts followed by a successful login within a configured time window.
Example:
Failed Login ↓ Failed Login ↓ Failed Login ↓ Successful Login ↓ Credential Attack Chain
SentinelX calculates a risk score between 0 and 100 for detected security alerts.
| Detection Type | Base Risk |
|---|---|
| Brute Force | 70 |
| Port Scan | 65 |
| Suspicious Admin Login | 60 |
| Firewall Block | 50 |
| Credential Attack Chain | 90 |
Risk levels:
0–39 → LOW 40–59 → MEDIUM 60–79 → HIGH 80–100 → CRITICAL
SentinelX provides an AI-assisted investigation layer for detected security alerts.
The investigation panel provides:
- Security assessment
- Risk classification
- Confidence level
- Supporting evidence
- MITRE ATT&CK technique mapping
- Investigation steps
- Recommended action
For example, a credential attack chain can be mapped to:
MITRE ATT&CK T1110 — Brute Force
SentinelX can generate an incident response plan based on the detected security alert.
The response plan provides:
- Recommended investigation actions
- Reason for each action
- Priority level for each action
- Suggested SOC investigation workflow
Example workflow:
Detect Threat ↓ Investigate Source IP ↓ Review Authentication Logs ↓ Verify Account Legitimacy ↓ Check Post-Login Activity ↓ Escalate / Resolve
SentinelX includes an interactive web-based Security Operations Center dashboard.
The dashboard provides:
- Real-time security alerts
- Severity filtering
- Alert search
- Risk-based sorting
- Risk distribution
- Top threat sources
- Attack type distribution
- Attack activity trend
- Recent telemetry and logs
- Incident history
- Security investigation panel
- AI investigation results
- Incident response plans
- Alert resolution workflow
The dashboard allows a security analyst to review detected threats, investigate individual alerts, generate response plans, and track incident status.
- Python
- FastAPI
- Uvicorn
- Pydantic
- SQLite
- React
- Vite
- JavaScript
- CSS
- Pytest
- Visual Studio Code
- Git
- GitHub
SentinelX/ │ ├── backend/ │ ├── main.py │ ├── database/ │ │ └── database.py │ ├── models/ │ │ ├── alert.py │ │ └── event.py │ ├── response/ │ │ └── response_engine.py │ └── risk/ │ └── risk_engine.py │ ├── collectors/ │ └── log_reader.py │ ├── detection/ │ ├── engine.py │ └── correlation.py │ ├── frontend/ │ ├── src/ │ │ ├── App.jsx │ │ ├── App.css │ │ ├── index.css │ │ └── main.jsx │ ├── package.json │ └── vite.config.js │ ├── tests/ │ ├── test_detection.py │ └── test_response_engine.py │ ├── sample.log ├── .gitignore └── README.md
python -m venv .venv
.venv\Scripts\Activate.ps1
python -m pip install fastapi uvicorn pydantic pytest
cd frontend npm install cd ..
python -m uvicorn backend.main:app
Backend: http://127.0.0.1:8000
cd frontend npm run dev
Frontend: http://localhost:5173
Run the automated test suite from the project root: python -m pytest -q Current verification: 8 tests passed.
SentinelX maintains a lifecycle for detected security alerts:
Detection ↓ Active Alert ↓ Investigation ↓ Resolved / False Positive ↓ Incident History
The repository ignores local development files and sensitive configuration files such as:
.venv/ pycache/ .env .env.* sentinelx.db *_backup.py backup_before.py
SentinelX is an academic cybersecurity project and SOC simulation rather than a production enterprise SIEM.
- Log collection currently focuses on local/sample log files.
- Detection is primarily rule-based.
- SQLite is used for local alert persistence.
- Telemetry sources are currently limited.
- Distributed multi-host collection is not implemented.
- Production authentication and authorization are not implemented.
- Automated malicious-IP blocking is not implemented.
- Advanced machine-learning anomaly detection is not currently implemented.
- Windows Event Log integration
- Linux Syslog integration
- Network packet monitoring
- Multi-host telemetry collection
- Machine-learning anomaly detection
- Threat-intelligence integration
- IOC enrichment
- Automated response playbooks
- Role-based access control
- PostgreSQL support
- Docker deployment
- Cloud deployment
- Email and Slack notifications
- Expanded MITRE ATT&CK coverage
The objective of SentinelX is to demonstrate how cybersecurity monitoring, detection, event correlation, risk assessment, investigation, and incident response can be integrated into a single SOC-oriented platform.
The project demonstrates practical concepts related to:
- Security Operations Centers (SOC)
- SIEM concepts
- Security event detection
- Event correlation
- Risk scoring
- Incident investigation
- Incident response
- MITRE ATT&CK
- Cybersecurity automation
- Full-stack security application development
SentinelX is intended for educational, research, and authorized security-testing environments.
Only use the platform against systems and data that you own or are explicitly authorized to monitor.
SentinelX — AI-Assisted Cybersecurity Detection Platform
Version: 1.0.0