SentinelIQ

• 

  scanning of ip hash, uel, domain, ip

• 

  results

• 

  results

• 

  log scanning

• 

  results

• 

  coding of project

• 

  pdf generation

• 

• 

Inspiration

The idea for SentinelIQ came from my networking and cybersecurity background gained through my time at Fortinet. Working hands-on with firewalls and threat data, I kept noticing a gap: most tools tell you something is malicious, but rarely tell you why. I wanted to build something that closes that gap.

What it does

SentinelIQ doesn't just flag an IOC (Indicator of Compromise) as malicious — it explains the reasoning behind the verdict, combining a machine learning risk score with an AI-generated, human-readable explanation grounded in real threat intelligence.

How we built it

SentinelIQ was built using a blend of modern AI tooling: Claude and GitHub Copilot for development assistance, Hugging Face pretrained embeddings for similarity-based scoring, and live threat intel from VirusTotal and AbuseIPDB. The explanation layer is powered by the Google Gemini API, enriched with MITRE ATT&CK context to ground every explanation in real-world adversary techniques.

Challenges we ran into

IOC detection is inherently noisy — file hashes, IPs, domains, and URLs all behave differently, and reliably parsing them at scale was harder than expected. Working with pretrained embeddings also proved tricky, from dimensionality mismatches to keeping the vector cache consistent as the reference dataset evolved.

Accomplishments that we're proud of

We built a fully functional, explainable threat intelligence pipeline without training a single model from scratch — proving that thoughtful architecture and the right pretrained tools can rival custom-built ML systems.

What we learned

Building SentinelIQ pushed us to think about AI systems as a layered pipeline rather than a single model. We learned how to combine embedding-based similarity search, live threat intel feeds, and LLM reasoning into one coherent scoring engine — and how much careful glue code it takes to make pretrained components (embeddings, RAG context, external APIs) work reliably together. We also learned the operational side of shipping an AI product: managing API keys, handling rate limits from external threat intel services, and deploying a full-stack app (FastAPI + Streamlit + PostgreSQL + ChromaDB) to the cloud under real infrastructure constraints.

What's next for SentinelIQ

Next, we plan to expand SentinelIQ's IOC coverage to include email addresses, integrate with live SIEM/SOAR pipelines for automated triage, and add historical trend analysis using the scan history already stored in PostgreSQL. We'd also like to deepen the MITRE ATT&CK mapping for richer, technique-level explanations, and explore real-time alerting so analysts are notified the moment a high-risk IOC is detected.

Built With

• abusepdb
• api
• gemini
• language:
• postgresql
• python
• virustotal