SENTINEL - Persistent Threat Hunter

The agent that remembers every byte, every login, every anomaly so no attacker can hide.

Comment

🛡️ Sentinel: Persistent Threat Hunter

The AI-powered security agent that never forgets.

💡 Inspiration

Traditional security systems often analyze alerts in isolation. An attacker may perform reconnaissance today, change tactics weeks later, and launch an attack months later.

We asked:

What if a security agent could remember every security event and continuously learn from its history?

This led to Sentinel — an AI-powered threat-hunting agent that combines persistent memory, semantic search, temporal correlation, and AI reasoning to uncover attack patterns that traditional systems can miss.

🧠 What We Learned

Effective AI security requires more than an LLM. Sentinel combines three layers of memory:

  • Episodic Memory — Complete security events and their context
  • Semantic Memory — Vector embeddings for similarity-based threat discovery
  • Temporal Memory — Historical relationships across extended periods

Security events are transformed into 1024-dimensional embeddings, allowing Sentinel to retrieve similar historical activity and provide that context to the AI reasoning layer.

Our experiments demonstrated approximately 73% improvement in threat-analysis performance when historical context was included compared with analyzing events independently.

🏗️ How We Built It

Event Ingestion
      ↓
Embedding Generation
      ↓
Persistent Storage
      ↓
Similarity Search
      ↓
Temporal Correlation
      ↓
AI Reasoning
      ↓
Autonomous Response
      ↓
Feedback & Learning

Technology Stack

  • Database: CockroachDB Cloud
  • AI: AWS Bedrock Titan, OpenAI, Local Models
  • Backend: Python, AsyncIO, aiohttp
  • Frontend: React
  • Cloud: AWS
  • Embeddings: AWS Titan, OpenAI, Sentence Transformers
  • Fallback: TF-IDF

CockroachDB acts as Sentinel's persistent memory layer, storing security events, embeddings, decisions, and historical context.

The AI pipeline supports automatic provider fallback:

AWS Bedrock
     ↓
OpenAI
     ↓
Local Models
     ↓
TF-IDF

This makes Sentinel resilient even when a particular AI provider is unavailable.

🚧 Challenges We Faced

Vector Indexing Limitations

Adapted our storage and similarity-search approach to work with the vector capabilities available in our database environment.

Database Serialization

Built a reusable conversion layer for UUIDs, timestamps, IP addresses, and complex database objects.

AI Model Availability

Designed a multi-provider architecture with automatic fallback when specific AI models were unavailable.

Real-Time Performance

Used asynchronous processing, connection pooling, caching, and temporal indexing to optimize event processing.

Security Event Representation

Developed semantic preprocessing that captures event attributes, user behavior, geography, authentication results, and temporal patterns.

🎯 Results

  • ⚡ ~200 ms average event-processing latency
  • 🔎 90+ days of historical threat correlation
  • 🚀 1,000+ events/minute test throughput
  • 📊 2,535+ security events processed
  • 🧠 ~73% improvement with historical context
  • 🔄 Multi-provider AI failover
  • 🤖 Automated threat scoring and response

🏆 Innovation

Sentinel introduces three core ideas:

1. Memory as a Service

Persistent semantic memory designed specifically for cybersecurity.

2. Temporal AI

AI reasoning that considers not only what is happening now, but also what happened before.

3. Distributed Intelligence

Combining AI reasoning with structured data, vector retrieval, and long-term persistent memory.

Traditional security:

Detect → Investigate → Forget

Sentinel:

Detect → Remember → Correlate → Reason → Act → Learn

🚀 What's Next?

Our roadmap includes:

  • Native vector indexing
  • Real-time attack clustering
  • Advanced AWS Bedrock reasoning
  • Multi-tenant enterprise deployment
  • Conversational threat investigation
  • Predictive threat modeling
  • Autonomous security orchestration

💫 Conclusion

Sentinel transforms cybersecurity from reactive alert management into memory-driven, predictive threat intelligence.

An isolated event may look harmless. But when Sentinel remembers related activity from weeks or months ago, it can connect the dots and reveal the bigger attack.

Attackers evolve. Sentinel remembers.

Built with ❤️ using CockroachDB, AWS Bedrock, OpenAI, Python, React, and persistent AI memory.

Built With

Share this project:

Updates

Submission history