Sentra – An AI Cybersecurity Agent

🧠 Inspiration

Modern cybersecurity operations centers (SOCs) are flooded with alerts and logs, making it difficult for analysts to detect genuine threats in real-time. Inspired by tools like Microsoft Sentinel and AI copilots, we wanted to create an intelligent agent that acts as a cybersecurity assistant—automating low-level tasks, analyzing logs, and assisting SOC teams with fast, actionable insights.

🔐 What it does

Sentra is an AI-powered cybersecurity assistant that:

• Ingests and analyzes security logs from various sources.
• Uses machine learning to detect anomalies and potential threats.
• Provides a natural-language interface to query threat data (e.g., "What was the top threat today?").
• Automatically maps detections to the MITRE ATT&CK framework.
• Executes response actions using automated playbooks.
• Generates easy-to-understand threat summaries and visual dashboards.

⚙️ How we built it

We used the following technologies and tools to build Sentra:

• Frontend: React.js, Tailwind CSS, Chart.js for dashboards
• Backend: Python (FastAPI) for API and ML model serving
• AI/ML: Scikit-learn, spaCy, OpenAI API for threat classification and NLP
• Data Sources: Sysmon, Suricata, Sigma rules, simulated log datasets
• Database: PostgreSQL for structured logs, Redis for real-time alerting
• Infrastructure: Docker containers deployed on Railway and Vercel
• Integrations: MITRE ATT&CK mapping, VirusTotal API, and MISP for threat intelligence

🚧 Challenges we ran into

• Parsing noisy log data consistently across different formats (Sysmon vs Suricata).
• Designing NLP prompts that provide reliable responses with security context.
• Balancing model accuracy vs performance, especially for anomaly detection.
• Implementing automated remediation without risking false positives.
• Creating a simple UI that works for both students and professional SOC users.

🏆 Accomplishments that we're proud of

• Built a working MVP of an AI cybersecurity assistant in just days.
• Created a conversational query interface that understands security-related questions.
• Successfully mapped live detections to MITRE ATT&CK techniques.
• Designed it in a way that students can use it to learn cybersecurity workflows.

📚 What we learned

• How powerful AI/NLP can be when paired with real-world cybersecurity logs.
• Importance of cleaning and normalizing log data for any ML application.
• How to build real-time alerting systems with limited resources.
• The balance between automation and analyst control in cybersecurity.

🚀 What's next for Sentra – A Student-Focused AI Assistant

• Build a cybersecurity training mode with fake attack scenarios for students.
• Add attack path visualizations and simulation tools.
• Support voice-based threat queries using Whisper and GPT.
• Deploy on a larger scale and integrate with open-source SIEM platforms.
• Launch a free tier for students and educational institutes to promote cybersecurity awareness.

Built With

• ai