How tejaskedarpawar/sentinel-ai works
Sentinel AI detects privacy-preserving insider-threat patterns from endpoint metadata, scores and explains employee-day risks, and presents alerts and threat relationships to SOC analysts. The main workflow is collection (simulated by default, with an optional live collector), Redis queuing, behavioral profiling, ensemble detection, risk scoring, explanation, and persistence; FastAPI serves results to the React dashboard. The README documents the full pipeline and dashboard capabilities; some router and frontend API internals were not sampled, so their wiring is shown only where documented or evident from sampled callers.
Main entry points: pipeline.py Pipeline orchestrator · App.jsx Dashboard application · database.py Database access · engine.py Detection ensemble
Components 20
Metadata collection
- Activity simulator
backend/app/collectors/simulator.py - Live collector
backend/app/collectors/live_collector.py - Redis event queue
Risk analysis
- Pipeline orchestrator
backend/app/pipeline.py - Behavior profiling
backend/app/profiling.py - Detection ensemble
backend/app/detection/engine.py - Autoencoder model
backend/app/detection/autoencoder.py - LSTM model
backend/app/detection/lstm.py - Risk scoring
backend/app/risk_engine.py - Alert explanations
backend/app/agent.py - Threat graph builder
backend/app/graph.py
API and storage
- Database access
backend/app/database.py - PostgreSQL
- FastAPI application
backend/app/main.py - API routers
backend/app/routers
SOC dashboard
- Dashboard application
frontend/src/App.jsx - API client
frontend/src/api.js - Dashboard panels
frontend/src/components - Threat graph view
frontend/src/components/ThreatGraph.jsx
Other components
- SOC analyst
Connections 20
- SOC analyst → Dashboard application: uses dashboard
- Pipeline orchestrator → Activity simulator: generates events
- Pipeline orchestrator → Redis event queue: pushes and drains
- Live collector → Redis event queue: pushes events
- Pipeline orchestrator → Behavior profiling: builds features
- Pipeline orchestrator → Detection ensemble: scores features
- Detection ensemble → Autoencoder model: fits and scores
- Detection ensemble → LSTM model: fits and scores
- Pipeline orchestrator → Risk scoring: computes risk
- Pipeline orchestrator → Alert explanations: explains flagged days
- Pipeline orchestrator → Threat graph builder: builds and persists graph
- Pipeline orchestrator → Database access: opens session
- Database access → PostgreSQL: connects to
- FastAPI application → Database access: initializes tables
- FastAPI application → API routers: registers routes
- API routers → Database access: reads records
- Dashboard application → API client: requests dashboard data
- API client → FastAPI application: calls backend API
- Dashboard application → Dashboard panels: renders dashboard
- Dashboard application → Threat graph view: renders graph view