How dulmina-hasith/sentinelx works
SentinelX monitors Linux SSH authentication logs, turns matching records into per-IP severity alerts, persists escalation state, and exposes telemetry and a live dashboard. The principal runtime path is configuration and log selection, file tailing, parsing, alert evaluation, persistence, then WebSocket delivery. The graph also includes the dashboard/API and privilege dropping. Source excerpts show the main orchestration and detection implementation; dashboard details beyond its template path and other unsampled behavior are kept limited to documented capabilities.
Main entry points: run.py Daemon orchestrator · alerts.py Alert engine · config.py Configuration loader · watcher.py Log tail and rotation
Components 14
Runtime setup
- Configuration loader
config.py - Daemon orchestrator
run.py - Privilege dropping
core/privileges.py
Log detection
- Log tail and rotation
core/watcher.py - SSH event parser
core/parser.py
Alert state
- Alert engine
core/alerts.py - Alert state file
Web interface
- Dashboard template
templates/index.html - Health and stats API
run.py - WebSocket transport
run.py
Other components
- Operator
- SSH auth log
- Dashboard user
- Environment settings
Connections 14
- Daemon orchestrator → Configuration loader: loads settings
- Environment settings → Configuration loader: overrides
- Daemon orchestrator → Environment settings: selects log path
- Daemon orchestrator → Log tail and rotation: starts tailing
- SSH auth log → Log tail and rotation: appends records
- Daemon orchestrator → SSH event parser: parses lines
- Daemon orchestrator → Alert engine: processes events
- Alert engine → Alert state file: loads and saves
- Daemon orchestrator → WebSocket transport: emits alerts
- Dashboard user → Health and stats API: requests telemetry
- Dashboard user → Daemon orchestrator: requests dashboard
- Daemon orchestrator → Dashboard template: renders page
- Dashboard user → WebSocket transport: receives alerts
- Daemon orchestrator → Privilege dropping: drops privileges