Sentinel - AI-augmented purple team platform — authorized off

项目说明

SENTINEL

AI-augmented purple team platform — TrustGeeks Security

!Tests
!License
!Python

SENTINEL is a purple-team platform: authorized offensi tooling
and defensi engineering, connected by one AI reasoning layer.
It doesn't replace Nmap, Nuclei, Sigma, or your SIEM — it orchestrates them,
scores what they find, maps it to MITRE ATT&CK, and tells you what to do
about it in plain language.

Read USAGE_POLICY.md before running this against anything.

What's actually built (tested, working today)

AutoPilot — adapti engine

After any stage, decides what to run next on its own: TLS check only if

443 is open, web vuln scan only if HTTP(S) is live, IP enrichment +
Sigma + correlation + incident report only when findings actually
warrant it — not a fixed checklist run every time regardless of context

Fully rule-based and offline-safe by default — the decision table works

with zero network access; the Claude API layer only adds a strategic
explanation on top when reachable, it ne the rule table's
hard decisions

Parallelizes independent I/O-bound work (e.g. enriching 5 source IPs at

once via a thread pool) instead of doing it serially

Still fully scope-gated on the offense side — autonomy ne

authorization

python cli.py auto-defend access.log / python cli.py auto-run <target> --scope scope.yaml

Defense

Brute-force detection (web + SSH/auth logs)

Reconnaissance/scan detection (path enumeration fingerprinting)

Explainable risk scoring (0–10) with a confidence score, not a black box

MITRE ATT&CK technique mapping per finding

Sigma rule generation (portable to Splunk/Elastic/Sentinel/QRadar via the

standard Sigma toolchain)

Multi-source correlation — same IP across web + auth logs escalates

se automatically, with a plain-English narrative

IOC extraction (IPs, domains, URLs, hashes) from arbitrary text

GeoIP/ASN enrichment (ip-api.com, no key needed) + optional AbuseIPDB

reputation lookup if you set ABUSEIPDB_API_KEY

Plugin SDK — drop in a custom detector without touching core code

Live C against NVD (by CVE ID or keyword search)

Alerting to Slack, Microsoft Teams, Discord, or any generic webhook

Offense (authorized only)

Asset discovery / port scanning (Nmap wrapper)

Passi enumeration (certificate transparency logs)

HTTP fingerprinting, TLS/cert posture checks

Nuclei-based C scanning

Hard scope gate — no bypass flag, on purpose (see USAGE_POLICY.md)

Reporting

Markdown and HTML incident reports with executi + per-finding

risk/MITRE/remediation detail

AI reasoning core

Claude API primary, local Ollama fallback for offline/air-gapped work

Ne findings — degrades to raw data with an honest "brain

offline" note rather than failing silently

Web dashboard

FastAPI backend, zero duplicated logic — same core/ package as the CLI

Dark SOC-style UI: paste a log, get risk-scored, MITRE-mapped findings

with a li gauge

u web.app:app --reload --port 8642

Architecture

Install

Usage

Offense — every engagement starts with a signed scope:

**Defense — analyze your own logs, with risk scoring, MITRE mapping, and
Sigma rules:**

Correlate across multiple log sources:

Enrich a single IOC:

Check AI backend status:

Let it decide what to do on its own (AutoPilot):

Look up a CVE:

Send high/critical findings to Slack/Teams/Discord:

Run the web dashboard:

Running the tests

What this deliberately does NOT do

Generate exploit code or no

Bypass the scope gate under any flag or config option

Fabricate reputation/threat-intel data when a lookup isn't configured or fails

Honest roadmap — not yet built

The full for this platform is larger than one release. Items below
are genuinely planned, not shipped yet — listed here instead of quietly
implied so the README always matches what's real:

SIEM/SOAR integrations (Splunk, Elastic, Wazuh, Sentinel, QRadar, TheHive, MISP)

Windows Event Log / Zeek / Suricata / CloudTrail / Azure / K8s audit log parsers

Metasploit RPC integration for a scope-gated exploitation stage

UEBA / baseline anomaly learning (current detection is threshold-based,

not beha yet)

Streaming/real-time log analysis (currently batch/file-based)

Multi-user, RBAC, SSO, audit logging, Docker/Kubernetes deployment

Signed releases, SBOM generation, CodeQL/Bandit scanning in CI

If you want to prioritize one of these next, that's the fastest way to keep
this moving — happy to build any of the above as a real, tested module
rather than a stub.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-augmented purple team platform — authorized offensive assessment + defensive detection, connected by an adaptive reasoning engine. TrustGeeks Security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。