SentinelFlow

Inspiration Alert fatigue is one of the biggest crises facing modern Security Operations Centers (SOCs). Human analysts are overwhelmed by thousands of daily alerts, making it impossible to investigate every threat manually and increasing the Mean Time To Respond (MTTR). We were inspired to build a solution that acts as a true force multiplier for security teams: a platform where a swarm of specialized AI agents works 24/7 to autonomously triage, investigate, and propose containment strategies for security incidents.

What it does SentinelFlow is an enterprise-grade, AI-powered Security Incident Response Orchestration Platform. Instead of relying on a single AI model, it utilizes a simulated swarm of 16 specialized AI agents (including Triage, Threat Intel, Malware Analysis, and Containment agents).

When a security incident is detected, the platform's orchestrator routes the threat through this multi-agent pipeline. SentinelFlow provides SOC analysts with a beautiful, dynamic dashboard where they can instantly view AI-generated root cause analyses, extracted Indicators of Compromise (IOCs), and mapped MITRE ATT&CK timelines. Crucially, SentinelFlow enforces a Human-in-the-Loop architecture: high-risk containment actions proposed by the AI are gated in an "Approvals" dashboard, ensuring human oversight before execution.

How we built it We utilized a modern, decoupled client-server architecture:

Frontend: Built with React and Vite for blazing-fast performance. We designed a premium, dark-themed UI utilizing TailwindCSS with glassmorphism effects and severity-based color coding. Data visualization (MTTR trends, alert volumes, and compliance scores) is powered by Recharts, while Zustand manages global state. Backend: Powered by Python and FastAPI. The backend handles secure JWT authentication, SQLite database management via SQLAlchemy, and the asynchronous event-driven orchestration engine that coordinates the execution of the simulated AI agents.

Challenges we ran into One of the primary challenges was architecting an asynchronous pipeline capable of orchestrating 16 distinct agents that need to share context and execute sequentially—all without blocking the frontend UI. We solved this by decoupling the investigation trigger from the HTTP response, allowing the frontend to poll for live execution logs while the backend processes the heavy lifting. We also had to overcome dependency compatibility issues between modern encryption libraries (passlib and bcrypt) to ensure secure, seamless authentication.

Accomplishments that we're proud of We are incredibly proud of the user experience. Security tools are notoriously clunky, but SentinelFlow feels modern, responsive, and intuitive. The dashboard seamlessly bridges the gap between complex AI logic and human oversight, distilling massive amounts of security data into actionable insights and clear KPI metrics.

What we learned We deepened our knowledge of asynchronous API design in FastAPI, complex state management in React, and how to effectively design user interfaces for critical human-in-the-loop AI systems. We also learned how to structure complex data visualizations using Recharts to present executive-level metrics (like ROI and Organizational Risk).

What's next for SentinelFlow Our next steps are to hook the simulated orchestration engine up to live LLM APIs (such as Gemini or Claude) to process real threat data. We also plan to implement WebSockets for live, bi-directional agent logging, and integrate the platform with live SIEM (Security Information and Event Management) data sources via webhooks.

Built With

• fastapi
• python
• react
• recharts
• sqlalchemy
• sqlite
• tailwindcss
• vite