How alaa-muhammad/sentinelcore works
SentinelCore is a host-based security-monitoring CLI. Its principal workflow is to collect live process, network, and file telemetry, identify suspicious activity, assess risk, and present operational and executive views; the README also documents correlation cases, alert/audit workflows, risk trends, scenario analysis, and recommendations. The CLI is the visible orchestrator. The supplied excerpts do not show the full scan loop or all repository wiring, so uncertain internal call edges are omitted.
Main entry points: main.py Interactive CLI · models.py Security domain models · process_collector.py Process collector · network_collector.py Network collector
Components 20
CLI orchestration
- Interactive CLI
main.py - Detection settings
config/settings.py
Telemetry collection
- Collector adapter
collectors/base.py - Process collector
collectors/process_collector.py - Network collector
collectors/network_collector.py - File watcher
collectors/file_watcher.py - Threat intel adapter
collectors/threat_intel_adapter.py - Local IOC list
config/ioc_local.csv
Security analysis
- Security analyzer
services/security_analyzer.py - Risk engine
services/risk_engine.py - Correlation engine
services/correlation_engine.py - Alert service
services/alert_service.py - Recommendation engine
services/recommendation_engine.py
Domain and storage
- Security domain models
domain/models.py - SQLite database
storage/db.py
Dashboards
- Analyst dashboard
views/dashboards.py - Executive dashboard
views/dashboards.py
Other components
- Operator
- Host OS
- Threat feed
Connections 27
- Operator → Interactive CLI: uses
- Interactive CLI → Process collector: starts collection
- Interactive CLI → Network collector: starts collection
- Interactive CLI → File watcher: starts monitoring
- Interactive CLI → Threat intel adapter: loads indicators
- Process collector → Host OS: reads processes
- Network collector → Host OS: reads connections
- File watcher → Host OS: watches changes
- Process collector → Detection settings: uses thresholds
- Network collector → Detection settings: uses thresholds
- File watcher → Detection settings: uses paths
- Threat intel adapter → Local IOC list: loads indicators
- Threat intel adapter → Threat feed: may fetch feeds
- Interactive CLI → Security analyzer: analyzes telemetry
- Interactive CLI → Risk engine: scores findings
- Interactive CLI → Correlation engine: correlates events
- Interactive CLI → Alert service: manages alerts
- Interactive CLI → Recommendation engine: generates insights
- Interactive CLI → Analyst dashboard: shows operations
- Interactive CLI → Executive dashboard: shows summaries
- Interactive CLI → SQLite database: uses repositories
- SQLite database → Security domain models: stores entities
- Security analyzer → Security domain models: produces events
- Risk engine → Security domain models: produces assessments
- Correlation engine → Security domain models: produces cases
- Alert service → Security domain models: creates alerts and audit
- Recommendation engine → Security domain models: produces recommendations