SentinelSandbox

An agentic security tool that uses GPT-5.6 and Codex to verify raw SIEM alerts by spinning up ephemeral Docker sandboxes and dynamically replaying exploit payloads.

Comment

Inspiration

Security Operations Center (SOC) analysts are routinely flooded with low-fidelity SIEM and WAF alerts. Investigating these alerts manually or running live exploit payloads against production target systems carries immense risk of downtime, data corruption, or unintentional compromise. Conversely, traditional sandboxes execute malicious binaries, but there was no safe automated standard for verifying whether an in-flight web attack pattern (e.g., path traversal or SQL injection) is actionable—without sending dangerous traffic to live customer environments.

We created SentinelSandbox to bridge this gap: providing SOC teams with automated, risk-free attack pattern verification by reproducing alerts exclusively against versioned, isolated synthetic fixtures in ephemeral sandbox environments.

What it does

SentinelSandbox ingests simulated SIEM alerts, redacts sensitive payload data, and safely verifies attack patterns using a zero-trust deterministic policy layer:

  • Redaction & Normalization: Ingests untrusted alert payloads, strips potential prompt injection and raw sensitive credentials, and structures the alert into a UI-safe record.
  • Deterministic Policy Gating: Selects an approved, versioned synthetic fixture contract (covering Path Traversal, LFI, SQL Injection, Reflected XSS, SSRF, and Command Injection) only if confidence thresholds are met. Unsupported or ambiguous alerts fail closed (NO_APPROVED_FIXTURE).
  • Hardened Ephemeral Verification: Spawns an isolated Docker environment (or in-memory demo evaluator) to run the attack pattern against a synthetic target. Workloads operate with zero network egress, read-only root filesystems, non-root users, dropped capabilities (CAP_DROP ALL), strict resource caps, and a strict 3-second wall-clock deadline.
  • Deterministic Verdicts: Returns explicit verdicts (SYNTHETIC_REPRODUCTION_SUCCESSFUL, NOT_REPRODUCED_IN_FIXTURE, POLICY_REJECTED, etc.) alongside sanitized evidence and an immutable, non-negotiable limitation disclaimer emphasizing that synthetic verification is triage evidence only.
  • Custom Mirror Fixtures: Admins can bind reviewed vulnerability logic to an organization's specific route shapes without altering underlying safe container code.
  • Audit & Data Retention: Maintains an append-only audit trail logging metadata (never raw payloads) and automatically sweeps/purges raw alert events after 24 hours.

How we built it

  • Backend: Built with Python 3.11+ and FastAPI, using Pydantic v2 for strict schema validation and an asynchronous job execution lifecycle backed by SQLite.
  • Container Architecture & Hardening: Developed versioned synthetic Docker images (sentinelsandbox/runner:1.0.0 and vulnerability targets) using Docker SDK for Python over isolated Docker bridge networks with no published host ports, no host bind mounts, no DNS egress, and full container security flags (no-new-privileges, read-only rootfs, user: 10001:10001).
  • Frontend: Built an interactive React Command Center using TypeScript, Vite, Tailwind-style dark mode aesthetics, and Lucide iconography, providing live job state tracking, payload redaction views, timeline logs, and row-click replay across audited job history.
  • Testing & Validation: Developed a comprehensive Pytest suite (including opt-in Docker isolation proofs for egress blocking and residue cleanup) and Vitest component tests with React Testing Library and MSW.

Challenges we ran into

  1. Absolute Egress & Egress Leak Isolation: Preventing runner containers from communicating with external networks or across parallel job execution boundaries required creating single-use, internal Docker networks (internal=True) per job and verifying daemon readiness at startup.
  2. Preventing AI Execution Authority: Designing a system that avoids prompt-injection traps when processing adversarial attack strings. We enforced a strict policy boundary where runtime execution decisions are 100% deterministic code paths rather than LLM-driven actions.
  3. Flawless Container Cleanup Under Deadlines: Guaranteeing zero leftover containers or orphaned networks when a sandbox job hits a hard wall-clock timeout (3s) or encounters an abrupt failure mode.
  4. Patched-Control Verification: Ensuring fixtures reliably distinguish between vulnerable modes (which output a synthetic marker) and patched control modes (which block the payload with HTTP 403) without race conditions during container startup.

Accomplishments that we're proud of

  • 100% Deterministic Safety Boundary: Built a system that never accepts a user-provided target URL or evaluates arbitrary code/shell commands, completely eliminating unintended external targeting.
  • Adversarial Docker Isolation Proofs: Automated test suites that rigorously prove zero internet/DNS egress, zero cross-job container reachability, total residue cleanup upon force kill, and container capability drops.
  • Zero Raw-Data Audit Trail: Engineered an audit logging system that records rich operational metadata for security compliance while mathematically guaranteeing raw alert payloads and credentials are never stored in audit logs.
  • Polished UX: Delivered a high-density React Security Command Center with real-time job status streaming, detailed evidence inspection, audit history replay, and clear vulnerability limitations.

What we learned

  • Defense-in-Depth for Security Automation: How to combine container-level security (seccomp, read-only rootfs, non-root execution) with application-level policy gating to process untrusted security data safely.
  • Triage vs. Remediation Boundaries: The importance of framing synthetic evidence accurately to security teams—proving an attack pattern reproduces synthetically speeds up initial triage without making false assumptions about live production state.
  • Reliable Async Lifecycle Design: Patterns for managing transient Docker container pairs within FastAPI background tasks while providing predictable readiness checks (/readyz) and fail-closed error handling.

What's next for SentinelSandbox

  • MicroVM Integration: Porting the ephemeral execution backend from Docker containers to microVM technologies (e.g., Firecracker or gVisor) for enhanced hypervisor-level tenant isolation.
  • Schema-Bounded LLM Integration (Phase 2): Enabling the reserved SENTINEL_AI_ENABLED feature flag to allow models like GPT-5.6 to draft structured InvestigationSpec proposals behind the deterministic policy gate.
  • SIEM & SOAR Connectors: Developing out-of-the-box ingestion webhooks for popular security tools like Splunk, Microsoft Sentinel, Elastic SIEM, and Shuffle SOAR.
  • Expanded Fixture Library: Expanding reviewed synthetic fixtures to cover GraphQL introspection leaks, JWT signature bypasses, and OAuth redirect vulnerabilities. ```

Built With

Share this project:

Updates