How suraj718549-cmyk/sentinelmind works
SentinelMind is a web-based SOC alert triage agent. Analysts submit alerts to the dashboard API, which runs stateless and memory-informed triage; the agent recalls relevant incident history when requested, reasons over each mode, and returns verdicts, confidence, rationales, and recalled memories. Analysts can submit feedback, which passes through source-trust, injection, and consistency checks before approved memories are retained. The README documents cross-host correlation and an offline fallback. Source excerpts are partial, so uncertain implementation links are omitted.
Main entry points: agent.py Sentinel Agent · web_server.py Dashboard API · llm_reasoner.py Reasoner Selection · hindsight_wrapper.py Memory Backend Adapter
Components 13
Dashboard and API
- Triage Dashboard
frontend - Dashboard API
scripts/web_server.py - Defense Audit Log
scripts/web_server.py
Triage and Reasoning
- Sentinel Agent
src/agent.py - Stateless Track
src/agent.py - Memory Track
src/agent.py - Reasoner Selection
src/llm_reasoner.py
Memory and Defense
- Memory Defense
src/memory_defense.py - Memory Backend Adapter
src/hindsight_wrapper.py
Inference and Storage
- Hindsight Memory
- Local Fallback Store
src/hindsight_wrapper.py - LLM Provider
Other components
- SOC Analyst
Connections 20
- SOC Analyst → Triage Dashboard: submits alerts
- Triage Dashboard → Dashboard API: sends requests
- Dashboard API → Sentinel Agent: runs triage
- Sentinel Agent → Stateless Track: evaluates alert
- Sentinel Agent → Memory Track: runs memory mode
- Stateless Track → Reasoner Selection: reasons without history
- Memory Track → Memory Backend Adapter: recalls history
- Memory Track → Reasoner Selection: reasons with context
- Reasoner Selection → LLM Provider: requests inference
- Reasoner Selection → Stateless Track: returns verdict
- Reasoner Selection → Memory Track: returns verdict
- Sentinel Agent → Dashboard API: returns triage results
- Dashboard API → Triage Dashboard: returns comparisons
- SOC Analyst → Triage Dashboard: provides feedback
- Dashboard API → Sentinel Agent: records feedback
- Sentinel Agent → Memory Defense: checks candidate memory
- Sentinel Agent → Memory Backend Adapter: retains approved memory
- Memory Backend Adapter → Hindsight Memory: recalls and retains
- Memory Backend Adapter → Local Fallback Store: reads and writes
- Dashboard API → Defense Audit Log: records defense outcome