How dr4cule/ntro-sentinel works
NTRO Sentinel passively turns mirrored traffic metadata or uploaded/replayed captures into bounded-window detections, correlated alerts, and tamper-evident records delivered through a REST/WebSocket API and analyst dashboard. The graph preserves the six documented threat classes, optional ML enrichment, and telemetry. The supplied tree does not include the dashboard asset, and several implementation excerpts are partial; dashboard delivery is therefore represented at the documented API surface, without inferring its internal implementation.
Main entry points: stream_consumer.py Stream Pipeline · service.py Ingest Service · store.py Hash-Chained Store · main.py REST and WebSocket API
Components 20
Metadata Ingest
- PCAP Adapter
ingest/pcap_to_events.py - Ingest Service
ingest/service.py - Event Normalizer
ingest/tailer.py
Detection Pipeline
- Stream Pipeline
engine/stream_consumer.py - Feature Windows
features - DDoS Detection
detectors/rules.py - C2 Detection
detectors/rules.py - DGA DNS Detection
detectors/rules.py - Encrypted Malware
detectors/rules.py - Recon Detection
detectors/rules.py - Exfil Detection
detectors/rules.py - Source Correlator
correlation/engine.py - Stream Metrics
engine/metrics.py
Evidence Store
- Hash-Chained Store
alertstore/store.py
Analyst Delivery
- REST and WebSocket API
api/main.py
Optional Enrichment
- ML Inference
models/inference.py
Other components
- Mirrored Traffic
- Capture Files
- Analyst
- Redis Stream
Connections 25
- Mirrored Traffic → Ingest Service: captures metadata
- Capture Files → Ingest Service: supplies captures
- Ingest Service → PCAP Adapter: parses PCAP
- Ingest Service → Event Normalizer: normalizes logs
- PCAP Adapter → Stream Pipeline: queues events
- Event Normalizer → Stream Pipeline: queues events
- Ingest Service → Stream Pipeline: dispatches events
- Stream Pipeline → Feature Windows: updates windows
- Stream Pipeline → DDoS Detection: evaluates
- Stream Pipeline → C2 Detection: evaluates
- Stream Pipeline → DGA DNS Detection: evaluates
- Stream Pipeline → Encrypted Malware: evaluates
- Stream Pipeline → Recon Detection: evaluates
- Stream Pipeline → Exfil Detection: evaluates
- Stream Pipeline → Source Correlator: correlates alerts
- Stream Pipeline → Hash-Chained Store: writes alerts
- Ingest Service → Hash-Chained Store: writes alerts and metrics
- Stream Pipeline → Stream Metrics: observes processing
- Ingest Service → Stream Metrics: observes processing
- REST and WebSocket API → Hash-Chained Store: reads and verifies
- REST and WebSocket API → Hash-Chained Store: appends alerts
- Analyst → REST and WebSocket API: views and queries
- Redis Stream → Stream Pipeline: streams events
- DGA DNS Detection → ML Inference: scores labels
- Exfil Detection → ML Inference: enriches evidence