Inspiration
Modern digital infrastructure generates millions of log lines and telemetry events every minute, but security and DevOps teams remain trapped in a cycle of alert fatigue. Critical signals routinely get buried beneath low-priority notifications, leading to delayed incident response and preventable downtime.
What it does
Sentinel is an autonomous telemetry monitoring and incident response engine designed to act as an on-call tier-1 engineer: 1)Real-Time Anomaly Stream Processing: Continuously monitors system metrics, error logs, and audit trails, clustering correlated anomalies to eliminate alert noise. 2)Semantic Root Cause Analysis: When an incident triggers, Sentinel cross-examines telemetry against recent code deployments, configuration commits, and historical outages using vector-indexed post-mortems. 3)Context-Rich Incident Briefs: Generates plain-language incident summaries outlining what broke, what services are affected, estimated blast radius, and confidence-scored hypotheses. 4)Interactive Remediation & Human-in-the-Loop Actions: Delivers alerts directly to Slack or Discord with pre-generated terminal commands, rollback pull requests, or toggleable infrastructure patches that engineers can approve with a single click.
How we built it
Sentinel is built on an event-driven, decoupled architecture designed for sub-second telemetry ingestion and rapid inference: 1)Frontend & Dashboards: Built with Next.js 14, Tailwind CSS, and shadcn/ui, featuring interactive dependency graphs powered by React Flow and real-time metric visualization using Recharts. 2)Ingestion & Backend Pipeline: An asynchronous FastAPI (Python) service orchestrates event streams, backed by Redis for real-time pub/sub queuing and PostgreSQL with pgvector to store and query system topology and historical runbooks. 3)Inference & Orchestration: Telemetry deduplication and incident synthesis run through an LLM orchestration layer that combines structural JSON parsing with dynamic context retrieval. 4)Integrations: Webhooks connect seamlessly to GitHub Actions, PagerDuty, and Slack, enabling closed-loop reporting and automated PR generation for rapid rollbacks.
Challenges we ran into
1)Context Window Budgeting During Cascading Failures: In large-scale outages, microservices can spit out gigabytes of duplicate logs within seconds. 2)Preventing Hallucinated Remediations: Autonomous infrastructure tooling cannot afford hallucinations. We enforced strict human-in-the-loop boundaries. 3)Balancing Embedding Latency with Real-Time Response: Querying high-dimensional vectors across thousands of historical incident reports added friction to early incident alerts
Accomplishments that we're proud of
1)High-Fidelity Triage Under 3 Seconds: Reduced the time it takes to synthesize an actionable incident root-cause hypothesis from 15+ minutes of manual investigation to under 3 seconds from log ingestion. 2)Zero-Setup Slack Integration: Built an interactive Slack bot interface that allows engineers to review root causes, inspect diffs, and approve mitigation workflows directly from their phones. 3)Cohesive End-to-End Demo: Successfully simulated a live Kubernetes deployment misconfiguration that triggered an automated alert, generated a git rollback patch, and alerted the team with an accurate, hallucination-free explanation of the faulty commit.
What we learned
1)Prompt Engineering for Structured Reliability: Leveraging strict schema validation (Pydantic and structured output constraints). 2)The Importance of Runbook Context: General foundation models struggle with internal architecture quirks. Grounding prompts with internal post-mortem embeddings radically improved the accuracy of the proposed fixes. 3)Telemetry Hygiene: Raw log output is notoriously noisy; building solid pre-processing heuristics proved just as crucial to our product's performance as the LLM layer itself.
What's next for Sentinel
1)Autonomous Sandbox Execution: Enable safe, automated test runs of suggested fixes inside isolated staging environments before presenting them to on-call engineers. 2)Multi-Cloud Log Connectors: Expand plug-and-play ingestion pipelines for AWS CloudWatch, Google Cloud Logging, and Datadog. 3)Edge & Local Model Support: Add support for running local open-weights models (via Ollama or vLLM) so privacy-conscious enterprises can deploy Sentinel on air-gapped infrastructure without external API dependencies.
Log in or sign up for Devpost to join the conversation.