SentinelOps

Inspiration

Modern incident response is still too fragmented. Even when teams already have Splunk and strong observability coverage, responders are forced to manually connect logs, deployments, service context, and communication into one coherent story while the incident is still unfolding.

We built SentinelOps because we wanted to turn that process into a guided, AI-assisted incident-command workflow. The goal was not to create another dashboard, but to create a system that helps teams understand what is happening, why it is happening, how far it spreads, and what to do next — fast

What it does

SentinelOps turns noisy Splunk signals into a structured incident investigation. It gathers evidence from Splunk indexes, correlates deployment events, generates an AI-powered incident brief, ranks likely root causes, estimates blast radius, and recommends next steps in a single operational flow.

It also supports follow-up investigation chat, SPL generation and explanation, external research through web search and OCR, and exportable outputs for Markdown, Slack, and Jira so the incident story can be shared across technical and leadership teams.

How we built it

We built SentinelOps as a modern full-stack application with React 18, Vite, TypeScript, Tailwind CSS, and shadcn/ui on the frontend, backed by Supabase Edge Functions, Supabase PostgreSQL, and Supabase Auth.

For intelligence, we used Gemini 2.5 Flash through a gateway pattern, Bing Smart Search for web context, OCR.space for text extraction from images, and Recharts for incident visualization.

To keep the product flexible, we created a Splunk abstraction layer with run_splunk_query, get_metadata, generate_spl, explain_spl, and get_saved_searches, which allows the same experience to run in demo mode, Splunk REST API mode, or an MCP-aligned integration mode without changing the UI.

Challenges we ran into

One of the biggest challenges was making the AI useful without making it feel vague or untrustworthy. In incident response, generic summaries are not enough — the system has to show evidence, explain reasoning, and help teams move toward a decision they can defend.

Another challenge was designing the integration architecture so it could support both reliable demo data and real Splunk connectivity. That required careful separation between the UI, the analysis functions, and the data access layer so we could keep the experience stable while still showing a realistic enterprise deployment path.

Accomplishments that we're proud of

We are proud that SentinelOps combines multiple pieces of the incident-response journey into one coherent experience. It is not just query generation, not just summarization, and not just alerting — it is a guided incident-command layer that brings together evidence gathering, hypothesis ranking, timeline analysis, blast-radius estimation, and communication export.

We are also proud of the demo scenario because it feels like a real production incident. The checkout-service regression shows SentinelOps identifying the deployment change, detecting the error pattern, ranking likely causes with confidence, and translating the technical issue into user and revenue impact.

What we learned

We learned that the most valuable AI systems in operations are not the ones that talk the most — they are the ones that help teams think better under pressure. In a real incident, responders need structured reasoning, not just text generation, so the workflow has to be grounded in telemetry, context, and traceable evidence.

We also learned that hackathon projects stand out when they solve a real workflow problem end-to-end. Strong visuals and AI features matter, but the bigger win is when the product actually mirrors how people work during an outage, from signal intake to investigation to reporting.

What's next for SentinelOps

Next, we want to expand SentinelOps into a deeper enterprise incident-intelligence platform. The most immediate roadmap items include real-time Splunk alert ingestion, saved alert import with one-click Run Now execution, auto severity detection, and stronger MCP connectivity with both Basic auth and Bearer token support.

Beyond that, we want to add enterprise-grade capabilities such as RBAC, audit trails, incident history, knowledge retention, Jira/Slack/ServiceNow/PagerDuty/Teams integrations, service topology visualization, RCA generation, predictive risk scoring, SOAR-style automation, and cross-source ingestion from SIEM, APM, cloud, CI/CD, and ticketing systems.

Built With

• ocr.spaceapi
• react18
• recharts
• shadcn/ui
• splunkmcpserver
• splunkrestapi
• supabasepostgresql
• supbaseedgefunction(deno)
• tailwindcss
• typescript
• vite