SentinelAI — AI-Powered SOC Platform

Overview

SentinelAI is an AI-powered Security Operations Center (SOC) investigation platform designed to help security analysts identify suspicious activity, understand potential threats, and prioritize security incidents. It transforms raw security logs into structured alerts, attack summaries, severity scores, MITRE ATT&CK mappings, and recommended response actions.

The goal is to make security investigation more understandable and efficient by combining rule-based threat detection with AI-assisted analysis in a single interface.

Inspiration

Security teams often deal with large volumes of logs, repeated alerts, and limited time to investigate suspicious events. Identifying an attack is only the first step; analysts must also understand what happened, assess its potential impact, determine its severity, and decide what to investigate next.

We wanted to build a practical prototype that brings these investigation steps together in one place. SentinelAI was developed around the idea that AI should assist security analysts by explaining detection results and suggesting next steps, while keeping the underlying detection logic visible and understandable.

What SentinelAI Does

The platform provides an end-to-end log investigation workflow:

Threat Detection: Identifies suspicious patterns such as SSH brute-force attempts, SQL injection, cross-site scripting, path traversal, and automated scanning.
Attack Correlation: Groups related alerts by source IP and identifies patterns that may indicate coordinated or multi-stage activity.
Severity Scoring: Assigns risk scores from 0 to 100 and categorizes findings from Low to Critical.
MITRE ATT&CK Mapping: Associates detected activity with relevant adversary techniques to help analysts understand the possible attack behavior.
AI-Assisted Investigation: Uses a locally hosted language model through Ollama to generate threat summaries, potential impact analysis, and recommended actions when the AI service is available.
IP Reputation Enrichment: Supports optional AbuseIPDB integration to obtain reputation information for external IP addresses.
Interactive Dashboard: Presents alerts, attack summaries, source IP information, and investigation findings through a Streamlit interface.
Command-Line Interface: Also supports log analysis through a CLI for users who prefer a terminal-based workflow.

How We Built It

SentinelAI was developed in Python with a modular architecture so that each stage of the investigation pipeline can be maintained and improved independently.

The application follows this workflow:

Log Input → Parsing → Rule-Based Detection → Alert Correlation → MITRE ATT&CK Mapping → Severity Scoring → AI-Assisted Analysis → Investigation Results

The detection engine processes supported SSH authentication and web application logs. Detection rules identify suspicious events, while the correlation engine groups related activity to provide additional context.

A severity-scoring component helps prioritize findings. MITRE ATT&CK mapping connects detections to recognized adversary techniques. The optional Ollama integration then uses the available detection findings to generate human-readable explanations and suggested response actions.

The Streamlit dashboard provides an accessible interface for exploring the results, while the CLI and modular core components support further development and testing.

Challenges We Faced

One of the main challenges was turning raw log entries into useful investigation results rather than simply displaying individual suspicious events.

We addressed this by separating log parsing, detection rules, correlation, scoring, and threat mapping into dedicated modules. Another challenge was making the output useful to analysts, which motivated the addition of attack summaries, severity levels, MITRE ATT&CK references, and AI-assisted explanations.

Integrating a locally hosted language model introduced an additional deployment consideration: a cloud-hosted application cannot automatically access Ollama running on a developer's laptop. The AI feature therefore depends on an accessible Ollama service, while the rule-based investigation workflow provides the foundation for detection.

Making the prototype publicly accessible also highlighted the difference between running a project locally and deploying it in a cloud environment, where dependencies, configuration, and external services must be handled appropriately.

What We Learned

Building SentinelAI helped us explore how multiple cybersecurity components can work together in a unified investigation pipeline. We learned the importance of modular architecture, explainable detection logic, alert correlation, risk prioritization, threat intelligence, and the practical limitations of integrating AI into security workflows.

We also learned that AI-generated explanations should support investigation rather than replace evidence-based analysis. Detection findings, supporting log events, and analyst verification remain important when deciding how to respond to an incident.

Impact and Future Scope

SentinelAI demonstrates how AI-assisted analysis can make security investigation workflows more accessible and structured. It is intended as a prototype for learning, demonstrating, and extending SOC investigation capabilities.

Future improvements could include broader Windows event-log support, additional detection rules, richer threat-intelligence integrations, persistent case management, improved evaluation against labeled datasets, and carefully controlled response automation with analyst approval.

Our vision is to build a practical AI-assisted SOC platform that helps analysts move from raw security events to clearer, better-prioritized investigations.