SentinelAI
An actively developed security engineering platform rather than a simple chatbot, SentinelAI unifies vulnerability intelligence, graph-based security knowledge, CVE exposure tracking, asset-software relationships, evidence management, and threat intelligence. Incorporates RAG architectures, CLI/API interfaces, and authorization/approval primitives for secure multi-step orchestration.
Standardized Case Study Specification (13 Parameters)
What is SentinelAI?
psychology Purpose & Problem Addressed
Vulnerability assessment workflows frequently suffer from fragmented tooling: reconnaissance port scans produce raw text banners, CVE feeds produce overwhelming noise without asset context, and remediation plans require tedious manual synthesis.
The portfolio project documentation describes SentinelAI as an active security engineering platform designed to resolve this fragmentation. Instead of relying on generic public chatbots that leak sensitive infrastructure details, SentinelAI operates strictly on-premises using local neural models to correlate security intelligence and structure findings into actionable roadmaps.
target Intended Audience & Scope
SentinelAI is built for security engineers, vulnerability analysts, and offensive security practitioners conducting authorized technical evaluations on owned or simulated lab systems.
It unifies log parsing, CVE correlation, CVSS scoring, and graph-based threat context while maintaining authorization and approval primitives at every dispatch stage, ensuring multi-step orchestration remains strictly auditable and controlled.
Security Knowledge Graph with MITRE ATT&CK mapping across tactic vectors and asset-software relationships.
Contextual exposure analysis engine correlating parsed service banners with CVE records and CVSS severity metrics.
Structured evidence management tracking findings and linking vulnerability records with actionable defensive remediations.
Local RAG pipeline, dual CLI/API dispatch interfaces, and comprehensive audit-logged orchestration primitives.
Documented System Architecture
Based on the documented architecture in the portfolio engineering specifications, SentinelAI organizes functionality across four tightly coupled tiers: Ingestion, Knowledge & CVE Intelligence, Local AI Reasoning, and Dispatch & Audit.
- • Nmap Service Banners
- • Asset-Software Maps
- • Target Scan Logs
- • MITRE ATT&CK Vectors
- • CVE Exposure Engine
- • CVSS Risk Calculation
- • Offline Neural Models
- • RAG Pipeline Context
- • Triage Prioritization
- • Approval Primitives
- • FastAPI & CLI Dispatch
- • Immutable Audit Logs
input Tier 1: Multi-Stage Telemetry Ingestion
Parses raw Nmap service banners, asset-software discovery maps, and target network scan logs into normalized JSON telemetry.
{
"event": "ingest.scan_telemetry",
"target_asset": "192.168.10.45",
"hostname": "prod-api-gw.internal",
"scanned_ports": [
{"port": 22, "service": "ssh", "product": "OpenSSH", "version": "8.2p1"},
{"port": 80, "service": "http", "product": "nginx", "version": "1.18.0"},
{"port": 8080, "service": "http-proxy", "product": "Apache Tomcat", "version": "9.0.30"}
],
"os_fingerprint": "Linux 5.4.0-generic Ubuntu 20.04",
"ingestion_status": "NORMALIZED_JSON_V2"
}Component Responsibility & Data Contract
| Component | Core Responsibility | Inputs | Outputs | Relationships |
|---|---|---|---|---|
| Reconnaissance Ingestion | Parses raw service scan outputs and normalizes service identifiers. | Nmap logs, banner strings | Normalized asset service dictionaries | Feeds into Knowledge Graph & CVE Engine |
| Knowledge Graph | Maps vulnerabilities and asset connections to MITRE ATT&CK tactic vectors. | Asset specs, vulnerability mappings | Graph nodes & attack paths | Enriches RAG context for neural triage |
| CVE Intelligence Engine | Performs contextual exposure analysis and CVSS risk scoring. | Service banners, version strings | CVE matches, severity ratings | Correlated with Knowledge Graph nodes |
| Local AI Reasoning (Ollama) | RAG pipeline evaluates combined context to generate remediation guidance. | RAG context, risk metadata | Prioritized remediation roadmaps | Operates strictly offline without cloud calls |
| Dispatch & Audit Layer | Exposes FastAPI/CLI endpoints governed by approval primitives and audit logs. | Remediation actions, user commands | Action execution records, audit logs | Guards system perimeter and logs operations |
Step-by-Step Documented Workflow
Reconnaissance scan logs, such as Nmap port scan service banners and asset configuration details, are submitted to the platform.
Parsed banners are correlated against CVE vulnerability intelligence and mapped into the MITRE ATT&CK knowledge graph across tactic vectors.
Local neural models running via Ollama evaluate contextual exposure and calculate CVSS-aligned risk priorities through the RAG pipeline.
Actions trigger authorization and approval primitives before dispatching remediation roadmaps through the FastAPI or CLI interfaces.
Structured evidence records are stored alongside immutable audit logs, providing full traceability for every assessed asset and action.
Technologies & Engineering Implementation
The platform core is developed in Python, offering dual operational interfaces: a structured FastAPI service layer for programmatic integration and an interactive CLI toolchain for rapid terminal-based triage during security exercises.
Incorporates a graph-based security knowledge model representing asset-software dependencies and mapping tactic vectors against the MITRE ATT&CK framework, coupled with a contextual CVE correlation engine.
Leverages Ollama for hosting offline neural models. The Retrieval-Augmented Generation (RAG) pipeline injects relevant vulnerability profiles and remediation playbooks directly into the inference context without transmitting any telemetry to third-party APIs.
Implements strict authorization and approval primitives guarding multi-step orchestration tasks. Every triage decision, remediation recommendation, and external dispatch is recorded in structured, immutable audit logs.
Verified Security Controls & Boundaries
As an engineering platform handling sensitive reconnaissance information and vulnerability assessments, SentinelAI embeds foundational defensive controls directly into its architecture.
Autonomous multi-step actions require explicit approval barriers. High-impact operations cannot be executed autonomously without deliberate human verification.
By running local neural models through Ollama on local hardware, sensitive vulnerability telemetry, service versions, and network topologies are never transmitted to external cloud endpoints.
All user inputs, model evaluations, and dispatch queries produce verifiable audit trails with timestamps to support compliance and technical post-mortem analysis.
Local AI Inference & RAG Architecture
The portfolio documentation defines SentinelAI's AI tier around local execution using the Ollama runtime. Instead of transmitting infrastructure data across third-party APIs, inference happens locally on private hardware.
Indices of MITRE ATT&CK techniques and CVE intelligence allow the system to fetch relevant defensive mitigation patterns on demand, augmenting the model's prompt context with deterministic security references.
Rather than generic severity scores, the reasoning engine combines CVSS metrics with asset-specific connectivity and software relationships to compute localized, contextual risk rankings.
Validation & Development Milestones
SentinelAI's progress is measured through structured engineering development phases. As verified in the portfolio documentation:
Covers full end-to-end integration of the Knowledge Graph, CVE Intelligence correlation engine, evidence management schema, and audit-logged CLI/API dispatch primitives.
Detailed testing suites, unit test coverage, and benchmark harnesses are maintained in the project repository.
Active Engineering Project
The core architecture is actively maintained and implemented through Phase 16. Development is actively proceeding on Phase 17 engineering objectives.
Planned Engineering Enhancements
- [Planned] Phase 17: Multi-asset lateral exposure reasoning across complex network graphs.
- [Planned] Automated remediation validation scripts with safe dry-run execution checks.
- [Planned] Deepened integration with local Kali Linux toolchains and telemetry feeds.