SentinelAI — Security Log Anomaly Detection
Risk-scored alerts from security events — a full-stack Mini-SIEM with ML detection, attack-chain correlation and explainable alerts.
Built by pragna · Cybersecurity Engineer Intern
The system, up close
Real captures from the running system — the demo, screenshots and architecture come first, then the deep dive.
Screenshots
Architecture
Why this needed to be built
Security teams face overwhelming volumes of login and access logs. Manual review does not scale, and early indicators of compromise — logins from high-risk geographies, unknown devices, credential-stuffing patterns — are often missed until damage is done.
Defenders need a system that can ingest events at API scale, score risk automatically, surface actionable alerts and give analysts enough evidence to trust and act on them.
What we built, and how it changes the workflow
SentinelAI is a full-stack Mini-SIEM that ingests authentication logs, detects anomalies using hybrid rule + ML detection, correlates multi-step attack chains, enriches events with threat intelligence and visualizes everything on a modern SOC dashboard.
Each incoming event is scored by location and device rules, then passed through a hybrid detection stage that combines Isolation Forest anomalies with per-user behavioural baselines. Alerts fire when the composite risk reaches ≥ 80 and are automatically mapped to MITRE ATT&CK techniques.
A correlation engine identifies multi-step attack patterns per user, threat-intelligence feeds enrich events with IOC matches, and SHAP attribution explains why the ML model flagged a particular event — giving analysts evidence they can actually investigate.
What it can do
A focused set of capabilities that define the system — no marketable filler, only what actually runs.
Log ingestion
REST API (POST /log) with Pydantic validation for security events.
Rule-based scoring
Location and device risk signals scored instantly on ingestion.
Hybrid ML detection
Isolation Forest anomalies combined with per-user behavioural baselines.
Alert generation
Automatic alerts at hybrid risk ≥ 80 with MITRE ATT&CK mapping.
Threat intelligence
IOC feed enrichment from JSON, CSV or mock feeds (17 default IOCs).
Correlation engine
Detects credential stuffing, account takeover, insider threat and impossible-travel chains.
Explainable AI
SHAP feature attribution with natural-language summaries for every ML anomaly.
JWT + RBAC
ADMIN / ANALYST / VIEWER roles plus guest sessions for demos.
Investigation workflow
Alert triage, timelines, incident reports and MITRE-based SOC actions.
Real-time dashboard
SentinelAI SOC UI with live metrics and 5-second polling.
The end-to-end workflow
The system processing path, in order.
- 1
Ingest
Security event arrives via POST /log with Pydantic validation.
- 2
Rule risk scoring
Location + device risk signals are scored immediately.
- 3
Store
Event is inserted into the security_logs store.
- 4
Hybrid detection
ML (Isolation Forest) + behavioural baseline + rule signals combine into a composite risk score.
- 5
Alert
If hybrid risk ≥ 80, an alert fires with MITRE ATT&CK mapping.
- 6
Correlate
The correlation engine checks 4 attack-chain patterns per user.
- 7
Enrich
IPs and locations are matched against IOC threat-intelligence feeds.
- 8
Explain
SHAP generates feature attribution for ML anomalies.
- 9
Respond
Analysts triage alerts, inspect evidence and build incident reports in the dashboard.
Stack & tech choices
- Backend
- Python 3.9+, FastAPI, Uvicorn
- Storage
- SQLite
- ML & explainability
- scikit-learn (Isolation Forest), SHAP, behavioural baselines
- Auth
- JWT, RBAC (ADMIN / ANALYST / VIEWER), guest sessions
- Threat intel
- IOC feeds (JSON / CSV / mock), IP and location enrichment
- Frontend
- React 18, SentinelAI SOC dashboard
- Testing
- 38 backend unit tests (unittest), frontend test
- Deployment
- Docker, docker-compose, log generator + ML training scripts
Tested, verified and honestly scoped
Validation & tests
Validated with 38 backend unit tests plus a curated demo dataset, seeded accounts and a comprehensive set of phase-level reports covering architecture, detection logic, security hardening and audits.
- Suspicious login detection — Russia/China logins and unknown devices flagged
- Behavioral deviation — events compared against per-user baselines
- Attack-chain detection — credential stuffing, account takeover, insider threat and impossible travel
- Threat enrichment — IPs/locations matched against IOC feeds
- Explanability — SHAP shows why the ML model flagged each event
- SOC visibility — real-time dashboard with MITRE ATT&CK mapping
- Demo guide — 5-minute and 10-minute demo scripts plus an analyst presentation checklist
Security & hardening
- Rule + ML hybrid scoring with composite risk thresholds (alert at ≥ 80)
- Correlation rules: credential stuffing (failed → failed → success), account takeover (new device → high risk → privileged access), insider threat (≥5 high-risk events in 24h), impossible travel (multiple locations within 2h)
- MITRE ATT&CK mapping — failed logins → T1110 Brute Force; successful logins → T1078 Valid Accounts; privileged access → T1078.004 Cloud Accounts
- Phase reports cover hardening, remediation, validation and a final release audit
Honest limitations
SentinelAI — Security Log Anomaly Detection is an internally developed engineering prototype. We state limitations rather than overclaim production readiness.
- Demo mode uses seeded accounts and a guest VIEWER session
- ML model artifact stored as a pickle (ONNX/skops planned)
- SQLite is fine for demo scale; PostgreSQL is planned for production workloads
- Threat feed is bundled/mock-based; external feeds (AbuseIPDB, AlienVault OTX) are on the roadmap
Deep-dive references
Documentation
SentinelAI ships with an extensive documentation set covering architecture, detection logic, ML, phases, audits and demo scripts.
Where this can go next
Realistic next steps we've scoped — not aspirational marketing copy.
- ONNX / skops model format to replace pickle
- Rate limiting on POST /log
- External threat feeds (AbuseIPDB, AlienVault OTX)
- PostgreSQL support for production scale
- E2E integration tests with Playwright
- Email / Slack alert notifications
- Geo-velocity impossible-travel detection
Have a similar workflow?
Zenera Labs can build a custom version for your business.
This is one of pragna's internally developed systems. Tell us about your requirement and we'll scope a tailored build around it.
Other systems we've built internally
AI Contract Analysis & Risk Detection
Faster document review with traceable evidence — upload a contract and get risk findings with source-verified citations.
naman · Engineering Portfolio
View case study
AI Data Analyst & Business Intelligence Agent
Evidence-grounded business intelligence from spreadsheets — upload CSV/XLSX, get analysis, visualizations and explained answers.
priyanka · Engineering Portfolio
View case study
Natural Language → SQL Analytics Assistant
Ask business data questions in plain English — get safe, validated SQL with grounded explanations.
naman · Engineering Portfolio
View case study