SentinelAI

Upload CSV or JSON security logs and start the SentinelAI analysis pipeline with optional Gemini-powered incident explanations.
Built-in sample datasets and automatic field recognition make it easy to test SentinelAI without manually mapping log fields.
The SOC dashboard summarizes 1,181 events with high-risk incidents, anomalies, MITRE ATT&CK coverage, risk scores, and timeline views.
Risk bands, MITRE ATT&CK techniques, tactic distribution, and a searchable incident list help users quickly prioritize suspicious activity.
Detailed incident view showing risk score, triggered rules, threat-intel indicators, and explainable evidence behind a Critical alert.
AI-assisted incident summary with attack-chain context, MITRE ATT&CK, anomaly evidence, and recommended response actions.

Inspiration

Security logs can contain hundreds or even thousands of events, making it difficult to quickly identify which activities actually require attention.

For cybersecurity students, junior analysts, and small teams, raw logs can also be difficult to interpret. Even when suspicious activity is detected, users still need to understand why it is suspicious, how serious it may be, and what they should investigate next.

I built SentinelAI to make security log analysis more understandable and actionable by combining explainable security rules, anomaly detection, MITRE ATT&CK context, and AI-assisted incident explanations.

What it does

SentinelAI is an AI-assisted security log analysis platform.

Users can upload security logs in CSV or JSON format. SentinelAI automatically processes the data and transforms raw events into prioritized and explainable security incidents.

The system provides:

Risk scores and severity levels
Rule-based detection
Isolation Forest anomaly detection
MITRE ATT&CK mapping
Gemini-powered incident explanations
Recommended response actions
A SOC-style security dashboard
Detailed incident investigation views

Instead of only showing whether an event is abnormal, SentinelAI helps users understand what happened, why it may be suspicious, how risky it is, and what they can investigate next.

How I built it

SentinelAI uses a multi-stage security analysis pipeline.

Uploaded CSV or JSON logs are first parsed and normalized into a consistent structure. The system then applies explainable rule-based detection to identify suspicious behaviours and calculate risk scores.

Isolation Forest is used as an unsupervised machine-learning layer to detect events that behave differently from the rest of the dataset.

Suspicious activity is then mapped to relevant MITRE ATT&CK techniques to provide additional cybersecurity context.

For High and Critical incidents, Gemini can generate a concise incident explanation and recommended investigation or response actions. If Gemini is unavailable or an API key is not configured, SentinelAI can fall back to a local heuristic explanation engine.

The final results are displayed through a SOC-style dashboard where users can review security statistics, risk distributions, detected techniques, suspicious source IPs, and individual incidents.

Challenges I ran into

One of the main challenges was combining different detection approaches without making the system unnecessarily complicated.

Rule-based detection is useful because the reason behind each alert can be explained clearly, while anomaly detection can identify unusual behaviour that may not match a predefined rule. I therefore designed SentinelAI to use both approaches together rather than relying entirely on one detection method.

Another challenge was deciding how generative AI should be used. Instead of allowing Gemini to make the entire security decision, SentinelAI performs its own risk scoring, anomaly detection, and MITRE ATT&CK mapping first. Gemini is used mainly as an explanation layer.

I also worked on making CSV and JSON inputs follow the same analysis pipeline despite having different input formats.

Accomplishments that I'm proud of

I was able to build an end-to-end security log analysis workflow that connects data processing, cybersecurity detection rules, machine learning, MITRE ATT&CK, generative AI, and a web-based dashboard in a single project.

SentinelAI can take a raw security log file and turn it into structured incidents that are easier to prioritize and investigate.

I also implemented a local fallback mode so that the main analysis workflow can continue even when Gemini is unavailable.

What I learned

Building SentinelAI gave me practical experience in designing a complete project rather than developing isolated features.

I learned how different components such as log preprocessing, rule engines, anomaly detection, APIs, frontend visualisation, and AI integration can work together as one processing pipeline.

I also gained a better understanding of Isolation Forest, MITRE ATT&CK mapping, FastAPI development, security log structures, and how generative AI can support cybersecurity analysis without replacing the underlying detection logic.

What's next for SentinelAI

SentinelAI is currently designed as a lightweight prototype rather than a replacement for enterprise SIEM platforms.

Future improvements could include real-time log ingestion, additional log formats, broader MITRE ATT&CK coverage, threat-intelligence integration, historical incident tracking, alert notifications, and more advanced behavioural analytics.

The long-term idea is to make security data easier to understand while keeping the detection process transparent and explainable.