SentinelAI

SentinelAI is and MCP-powered AI incident analyst that uses Splunk Hosted Models to autonomously investigate logs and generate actionable incident intelligence.

Comment

## Inspiration

Security Operations Centers (SOCs) generate an overwhelming amount of telemetry every day. While SIEM platforms like Splunk provide incredible visibility, analysts still spend significant time manually searching logs, correlating alerts, mapping threats to frameworks, and writing reports.

During the rise of agentic AI systems, we started asking a simple question:

What if security analysts could work alongside autonomous AI agents that continuously investigate threats instead of only reacting to alerts?

That idea became SentinelAI.

We wanted to build a system that combines Splunk's powerful telemetry capabilities with autonomous reasoning, machine learning, and Cyber Threat Intelligence (CTI) generation. Rather than simply detecting anomalies, SentinelAI aims to understand them, classify them, and tell the complete story behind an attack.

## What it does

SentinelAI is an autonomous Security Operations and Cyber Threat Intelligence platform built on top of Splunk.

The platform continuously ingests security telemetry, detects suspicious behavior using statistical and machine learning techniques, correlates events into meaningful attack narratives, maps activity to the MITRE ATT&CK framework, and automatically generates CTI reports for analysts.

Key capabilities include:

  • Continuous Splunk telemetry monitoring
  • Statistical anomaly detection using Z-Score analysis
  • Machine learning anomaly detection using Isolation Forest
  • Autonomous threat classification
  • MITRE ATT&CK mapping
  • CTI report generation
  • Supabase-backed intelligence storage
  • Agentic threat hunting through MCP tools
  • Interactive Streamlit dashboard
  • Built-in attack simulation framework

Instead of presenting analysts with raw alerts, SentinelAI provides context, intelligence, and actionable insights.

## How we built it

We designed SentinelAI as a collection of loosely coupled components working together.

At the ingestion layer, a dedicated Splunk daemon continuously queries Splunk Enterprise and collects telemetry independent of the frontend.

The analytics layer consists of two anomaly engines:

  1. A statistical detector using rolling Z-Score calculations.
  2. A machine learning detector powered by Isolation Forest.

To avoid data leakage and overfitting, the machine learning model is trained only on historical observations while predictions are made on the newest incoming events.

The intelligence layer classifies anomalies, builds attack timelines, maps activity to MITRE ATT&CK techniques, and generates structured CTI reports.

We then implemented a custom Model Context Protocol (MCP) server that allows AI agents to securely interact with Splunk data through controlled tools and query interfaces.

All generated intelligence is stored in Supabase, while a Streamlit dashboard provides analysts with a centralized operational view.

The overall result is a system that can move from telemetry to intelligence with minimal human intervention.

## Challenges we ran into

One of the biggest challenges was designing the system to feel truly autonomous instead of simply being a collection of dashboards and machine learning models.

Another challenge was anomaly detection. Security telemetry is noisy, and naive approaches often generate large numbers of false positives. We spent significant effort balancing statistical methods with machine learning approaches to improve signal quality.

Building the MCP integration was also challenging. We needed a way for AI agents to interact with Splunk safely while maintaining clear boundaries around what queries could be executed.

Data leakage was another important concern. During development, we discovered that many anomaly detection examples unintentionally train on the same data they evaluate. We redesigned our pipeline so that models learn from historical windows and evaluate only unseen events.

Finally, converting isolated anomalies into meaningful CTI narratives required correlating events across time, users, hosts, and attack stages rather than treating each alert independently.

## Accomplishments that we're proud of

We are particularly proud of building an end-to-end autonomous intelligence workflow rather than a standalone detection engine.

Some highlights include:

  • Successfully integrating Splunk, MCP, Streamlit, and Supabase into a single platform.
  • Building a continuously running telemetry ingestion pipeline.
  • Implementing both statistical and machine learning anomaly detection methods.
  • Creating an automated MITRE ATT&CK mapping workflow.
  • Generating structured CTI reports automatically from detected incidents.
  • Designing an architecture that allows AI agents to participate directly in threat hunting activities.

Most importantly, we built a system that focuses on turning security data into intelligence rather than simply producing more alerts.

## What we learned

This project taught us that anomaly detection is only a small part of the security intelligence problem.

A detected anomaly has limited value unless it can be explained, correlated, and contextualized. The most useful output for analysts is not necessarily an alert—it is understanding.

We also learned how powerful agentic workflows can become when connected to operational security systems. MCP provided a structured way to bridge AI reasoning with enterprise data sources while maintaining control and transparency.

On the engineering side, we gained valuable experience designing asynchronous data pipelines, integrating Splunk services, building anomaly detection models, and constructing CTI generation workflows.

Most importantly, we learned that effective security automation requires a balance between machine intelligence and human trust.

## What's next for SentinelAI

This project is only the beginning.

Future improvements we would like to explore include:

  • Multi-agent investigation workflows
  • Integration with additional SIEM platforms
  • Real-time threat intelligence feed enrichment
  • Automated SOAR playbook execution
  • Sigma rule generation from detected attacks
  • Natural language threat hunting interfaces
  • Advanced graph-based attack correlation
  • Fine-tuned cybersecurity language models
  • Automated incident response recommendations

Our long-term vision is to create a fully autonomous security intelligence platform that helps analysts spend less time searching for threats and more time understanding them.

SentinelAI represents a step toward that future.

Built With

Share this project:

Updates