Inspiration
As a threat detection engineer, I spend my days triaging Splunk alerts — thousands a day, most of them noise, with the real attack hiding somewhere inside. I built the agent I wish I had on shift: one that scores, enriches, and correlates alerts before a human ever looks at them.
What it does
Every SOC drowns in alerts: thousands a day, most of them noise, with the real attack hiding somewhere inside. Tier-1 triage is slow, exhausting, and doesn't scale.
Sentinel Triage is an AI SOC analyst agent that does the first pass:
- Ingests security alerts (Splunk/CrowdStrike-style, with one click of mock generation)
- Scores each alert 0–100 with NVIDIA Nemotron models — ransomware-like file renaming lands at 95, backup jobs correctly drop to 15–25 as false positives
- Enriches every indicator with live threat intel from Tavily — MITRE ATT&CK context, security blogs, with sources
- Correlates related alerts into incidents and writes the analyst an incident brief with a response plan
- Hands over a prioritized queue — reasoning included, not just scores
It doesn't replace the analyst. It clears the noise so the analyst starts from answers.
How we built it
- Backend: Python + FastAPI. Frontend: React.
- Two-model routing: a small, fast Nemotron model scores every alert cheaply; a large reasoning model wakes up only for incident briefs and response plans.
- All inference on Nebius Token Factory using NVIDIA open models.
- Tavily for live threat-intel enrichment on every indicator.
- Deployed on Render (public demo), code public on GitHub under the MIT license.
Challenges we ran into
- Making mock alerts realistic enough to demo real triage behavior (scoring had to feel honest, not rigged).
- Keeping per-alert triage fast and cheap — solved with two-model routing instead of sending everything to the big model.
- Render's free tier sleeps the backend (~30s cold start) — worked around in the demo flow, and documented for judges.
- Fitting the full story (problem → live triage → enrichment → incident brief) into a sub-3-minute video.
Accomplishments that we're proud of
- Full end-to-end pipeline live on a public URL: 8 mock alerts generated, scored, enriched, and correlated into an incident brief.
- Smoke tests and an end-to-end test passing; live demo verified working.
- Two-model routing that demonstrably pushes false positives to the bottom of the queue.
What we learned
- Analyst trust comes from showing reasoning, not just scores — a 95 with an explanation is a tool; a 95 alone is a black box.
- Open models on Token Factory are fast enough for interactive triage, and reserving the reasoning model for briefs keeps the demo cheap.
- A hackathon MVP can still be honest about production gaps: real SIEM connectors, analyst feedback loops, auth/audit trails, and private deployment are the roadmap.
What's next for Sentinel Triage
- Real SIEM API connectors (Splunk, Elastic) replacing mock alerts.
- Analyst feedback loop so corrections improve scoring over time.
- Login + audit trails, and private deployment — raw telemetry should never hit a public demo.
- Packaging it as portfolio work for SOC / threat-detection roles.
Log in or sign up for Devpost to join the conversation.