SentinelTI – Enterprise AI Threat Intelligence & Case Management Platform

SentinelTI is a production-grade, enterprise-level cybersecurity SaaS platform designed for SOC Analysts, Threat Researchers, Security Engineers, and Incident Responders.

---

🎯 Architecture & Features Overview

                          ┌──────────────────────────┐
                          │   Next.js 15 App Router   │
                          │   (TypeScript / Tailwind)│
                          └─────────────┬────────────┘
                                        │ REST API (JSON)
                                        ▼
                          ┌──────────────────────────┐
                          │    FastAPI Backend API   │
                          │   (Clean Architecture)   │
                          └──────┬────────────┬──────┘
                                 │            │
             ┌───────────────────┴──┐      ┌──┴──────────────────┐
             │ Multi-Provider Engine│      │  AI Copilot Engine  │
             │ (VT, AbuseIPDB, OTX, │      │   (Google Gemini /  │
             │  URLScan, Shodan)    │      │    Sigma & YARA)    │
             └──────────────────────┘      └─────────────────────┘

Core Modules

1. Indicator of Compromise (IOC) Investigation:

   • Auto-detection & defanging for 7 IOC types (IPv4, IPv6, Domain, URL, MD5, SHA1, SHA256).
   • Multi-provider async orchestration (VirusTotal, AbuseIPDB, AlienVault OTX, URLScan.io, Shodan).
   • Resilient provider interface with automatic structure-validated mock fallback when API keys are absent.

2. Dynamic Risk Scoring Engine:

   • Quantitative 0–100 weighted threat risk algorithm (Safe, Low, Medium, High, Critical).

3. MITRE ATT&CK Mapping Engine:

   • Automated mapping of provider tags, open ports, and malware signatures to MITRE Tactics & Techniques.

4. Conversational AI Security Copilot:

   • Powered by Google Gemini API with intelligent mock engine fallback.
   • Interactive Q&A (Why is this malicious?, MITRE explanations, Tier-1 action steps, containment plans).
   • Automated Sigma Rule (YAML) and YARA Rule generation.

5. Full Case Management Module:

   • Incident case tracking, priority levels, analyst assignment, evidence attachment, analyst notes, and interactive timelines.

6. Interactive Relationship Graph:

   • Visual correlation nodes connecting IPs, Domains, File Hashes, Malware Families, and APT Threat Actors.

7. Executive PDF Reports:

   • Enterprise report export generated on-demand using ReportLab.

---

🚀 Quick Start Guide (Local Python Virtual Environment & SQLite)

1. Backend Setup

Prerequisites

• Python 3.11+
• SQLite3 (included with Python)

Option A: Quick Setup (Automated Scripts)

Windows:

cd backend
setup_venv.bat

Linux / macOS:

cd backend
chmod +x setup_venv.sh
./setup_venv.sh

Option B: Manual Setup

1. Navigate to backend directory:

   cd backend

2. Create and Activate Python Virtual Environment:

   # Windows
   python -m venv .venv
   .venv\Scripts\activate
   
   # Linux / macOS
   python3 -m venv .venv
   source .venv/bin/activate

3. Install Dependencies:

   pip install --upgrade pip
   pip install -r requirements.txt

4. Configure Environment Variables: Copy .env.example to .env:

   cp .env.example .env

5. Run FastAPI Backend Server:

   python main.py
   # OR
   uvicorn main:app --reload --port 8000

   FastAPI server starts at http://localhost:8000.
   Swagger API Documentation available at http://localhost:8000/api/v1/docs.

---

2. Frontend Setup (Next.js 15)

1. Navigate to frontend directory:

   cd frontend

2. Install Node.js Dependencies:

   npm install

3. Configure Environment Variables: Copy .env.example to .env.local:

   cp .env.example .env.local

4. Run Next.js Development Server:

   npm run dev

   Open http://localhost:3000 in your browser.

---

🐳 Docker Deployment Guide

To launch the entire platform stack (FastAPI Backend + Next.js Frontend) using Docker Compose:

docker-compose up --build

• Frontend Application: http://localhost:3000
• Backend API: http://localhost:8000
• Swagger Interactive API Documentation: http://localhost:8000/api/v1/docs

To stop the environment:

docker-compose down

---

🗄️ Database Configuration & PostgreSQL Migration Guide

SentinelTI uses SQLAlchemy 2.0 (Async) and supports both SQLite for zero-setup local development and PostgreSQL for enterprise production deployments.

Local Development (SQLite - Default)

In backend/.env:

DATABASE_URL="sqlite+aiosqlite:///./sentinelti.db"

Production Deployment (PostgreSQL)

1. Install asyncpg (included in requirements.txt).
2. Update DATABASE_URL in backend/.env:

   DATABASE_URL="postgresql+asyncpg://<username>:<password>@<host>:5432/<database_name>"

3. Restart backend server; tables will automatically initialize on startup via async metadata creation.

---

🧪 Testing & Verification

Run automated backend test suite (unit tests & end-to-end integration tests):

cd backend
python -m pytest tests/

Run frontend TypeScript verification:

cd frontend
npx tsc --noEmit

---

🛡️ Security & Privacy Features

• Defanging: Prevents accidental clicks on live malicious domains/URLs by auto-converting http:// -> hxxp:// and . -> [.].
• JWT & Role-Based Access Control (RBAC): Secure access tokens with role enforcement.
• Graceful API Key Fallback: If API keys for external threat providers or LLMs are absent, SentinelTI automatically engages structure-validated mock generators without exposing errors or interrupting SOC workflow.