Protocol SIFT Sentinel

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Protocol SIFT Sentinel

Inspiration

AI-enabled attackers can move faster than a human responder can open the right tools. FIND EVIL! asks for the defensive version of that speed: an agent that can reason through evidence, recognize when its first conclusion is weak, and self-correct before handing a report to analysts.

What it does

Protocol SIFT Sentinel ingests SSH, web, EDR, and DNS evidence, normalizes the events into a timeline, detects suspicious behavior, correlates weak signals, and emits an incident report with evidence IDs, confidence scores, SHA-256 hashes, and a JSON audit trail.

How I built it

I built a Python 3.11 prototype around a SIFT-style workflow: evidence loader, normalizer, detector pass, correlation graph, self-correction pass, and report writer. The bundled case simulates SSH credential pressure, PHP upload, web-shell style process launch, and newly observed DNS beaconing.

What makes it agentic

The agent does not stop at first-pass alerts. It initially treats SSH brute force as isolated, then challenges that assumption. When the PHP upload, DNS beacon, and EDR process evidence line up in time on the same host, it promotes the case to a critical coordinated compromise.

Challenges I ran into

The biggest challenge was making the agent useful without becoming a black box. I kept the outputs deterministic and evidence-linked, so every finding can be traced back to event IDs and preserved input hashes.

Accomplishments that I am proud of

The project produces a complete analyst handoff: Markdown report, JSON report, audit log, architecture notes, accuracy report, execution trace, hosted demo, and public repository.

What I learned

Autonomous IR agents need humility as much as speed. The useful pattern is not just tool execution, but a loop that questions early assumptions and explains why a conclusion changed.

What's next

Next I would connect the same loop to the full SIFT Workstation and Protocol SIFT MCP surface, add richer forensic artifact parsers, and evaluate the self-correction behavior on larger compromised-system datasets.

Built With

• ai-agents
• audit-logs
• cybersecurity
• dfir
• evidence-correlation
• incident-response
• machine-learning-ai
• protocol-sift
• python
• sans-sift
• self-correction