SentinelFlow AI

Production-ready AI SOC Autopilot that automates alert enrichment, investigation, decision-making, human approval, and remediation using LangGraph, Qwen Cloud, and Alibaba Cloud.

Comment

Inspiration

Security Operations Centers (SOCs) face an overwhelming number of alerts every day, many of which require repetitive manual investigation before analysts can determine whether they are genuine threats. Existing automation tools rely heavily on static playbooks and often lack contextual reasoning, making it difficult to automate complex security decisions safely.

We built SentinelFlow AI to demonstrate how Large Language Models, structured AI workflows, and human-in-the-loop approval can work together to reduce analyst workload while maintaining trust, transparency, and control. Our goal was to create an AI-powered SOC assistant that helps security teams respond faster without replacing human judgment.

What it does

SentinelFlow AI is an autonomous Security Operations (SOC) incident response agent powered by Qwen Cloud and orchestrated using LangGraph.

The platform:

🚨 Ingests alerts from EDR, Firewall, SIEM, and CVE feeds 🔍 Enriches alerts with threat intelligence and vulnerability context 🧠 Uses Qwen Cloud to investigate, classify, and prioritize incidents 💡 Recommends remediation actions with explainable reasoning 👨‍💻 Sends critical actions through a human approval workflow ⚡ Executes approved remediation automatically 📜 Generates audit logs for complete traceability

This creates an end-to-end AI-assisted security workflow that combines intelligent automation with human oversight.

How we built it

The system is designed as a modular AI workflow using LangGraph StateGraph, where each stage performs a specific responsibility:

Alert Sources

EDR Firewall SIEM CVE Feed

↓

LangGraph Pipeline

Enrich Triage Decide Human Approval Execute

↓

Qwen Cloud API

↓

Alibaba Cloud Function Compute

↓

Live Operations Dashboard & Audit Logs

Tech Stack Python Flask LangGraph Qwen Cloud API Alibaba Cloud Function Compute HTML CSS JavaScript REST APIs

The backend is deployed on Alibaba Cloud Function Compute, while the frontend provides a live dashboard for analysts to review and approve AI-generated remediation actions.

Challenges we ran into

Building an autonomous security agent required balancing automation with safety.

Some of our biggest challenges included:

Designing an AI workflow that produces consistent security decisions. Preventing unsafe or hallucinated remediation recommendations. Implementing a reliable human approval gate before executing high-impact actions. Structuring LangGraph states so contextual information flows efficiently between stages. Creating an architecture that is modular, scalable, and easy to extend with additional tools.

Accomplishments that we're proud of

✅ Built a complete end-to-end AI SOC workflow. ✅ Successfully integrated Qwen Cloud into a production-style reasoning pipeline. ✅ Implemented human-in-the-loop approvals for safe autonomous execution. ✅ Designed a modular LangGraph architecture that can be expanded with additional security tools. ✅ Deployed the backend using Alibaba Cloud Function Compute. ✅ Created a clean SOC dashboard for reviewing alerts and AI decisions. ✅ Produced an explainable and auditable incident response pipeline.

What we learned

Throughout this project, we gained valuable experience in:

Building production-ready AI agents using LangGraph. Designing explainable AI workflows for cybersecurity. Integrating Qwen Cloud models into real-world automation pipelines. Deploying serverless AI applications on Alibaba Cloud. Designing systems that combine AI reasoning with human oversight for safer decision-making. Creating modular architectures that can evolve into enterprise-scale security platforms.

What's next for SentinelFlow AI

We're excited to continue evolving SentinelFlow AI into a full enterprise-grade autonomous SOC platform.

Our roadmap includes:

🤝 Multi-agent collaboration for specialized security tasks. 🧩 MCP integrations for broader enterprise tooling. 🧠 Persistent memory to learn from previous incidents. 🌍 Real-time threat intelligence integration. 🦠 Automated malware sandbox analysis. 📊 SIEM and SOAR platform integrations. 🔐 Role-Based Access Control (RBAC) and multi-tenant support. 📈 Advanced analytics and incident trend visualization. 💬 Natural language investigations for SOC analysts. 🚀 Self-improving remediation strategies powered by feedback and historical outcomes.

Built With

Share this project:

Updates