Every session sandboxed, continuously scored, and converted in place . They keep the session, and lose the world behind it.
The score decays. Evidence has to keep arriving.
Ten layers, L0 ingress through L9 console
A session's score is a point moving over a field of weighted behavioural evidence. Early on the field is noise, because nothing has converged and nothing should. As recon turns into enumeration and enumeration into exploitation, the surface deepens into a basin, and the trajectory falls into it.
$ cat /etc/passwdBroadband noise, no basin. Weak passive priors only: GeoIP, JA4, HASSH, reputation. None of it is a verdict.
$ grep -rIl 'PASSWORD\|SECRET' /srv /optEvidence accumulating faster than it decays. A minimum is forming, but the session keeps full backend reachability.
$ cat /etc/shadowThe basin is decisive and the trajectory has crossed T. Conversion fires, and scoring carries on afterwards.
One recorded session, replayed against the live scoring rule. The commands, the weights and the moment the score crosses T are all read from the model. The playback only controls when each observation appears. Watch the right-hand column at the crossing: the backend swaps, and nothing about the session does.
Same container, real internal services. Nothing has crossed the threshold yet.
Relocation leaks. ls, uptime, /proc, the process tree, the files they already dropped: any one of them gives away the move to a honeypot. Staying put is the deception.
Every inbound session is containerised before anything is known about it. The safe boundary is not something switched on once a connection starts to look bad.
Every conversion is written to the event log with the network state before and after. None of it is reconstructed later for the timeline.
The same shell process, either side of conversion
Backend reachability
At threshold Tbackend_net detached, deception_net attached, container untouched
Real secrets reachable after conversion
NONENothing about the attacker's local state changes. The management network is deliberately untouched, so the live SSH session never drops.
Everything else is identical either side: PID 412 bash and PID 431 curl are the same processes, cwd is still /home/deploy, shell history, env vars, dropped files and uptime in /proc all read exactly as they did a second earlier.
Each of these had a live session doing observable things inside someone's network. The left column is public post-incident reporting. The right is what this design is built to do against the same behaviour.
A server-side request forgery reached the cloud metadata service, and the credentials it returned were real.
The request still succeeds. What comes back is fabricated, and what leaves is nothing.
SentinelX does not fix the WAF misconfiguration that made the SSRF reachable. It changes what the SSRF is worth.
Design claims, not measured results. SentinelX does not patch vulnerabilities and would not have prevented these breaches. It contains the session that exploits one, and keeps the record. Each case states where it would not have helped.
Read the threat modelContainerise first, decide later. Conversion only works because the session already lives somewhere controllable. We never wait to identify an attacker before building the box.
Suspicious evidence raises the score; time and benign behaviour lower it again. Cumulative scoring catches the slow campaign, synchronous request checks catch the single shot.
Four ordered operations inside one running container. The management network is not one of them, which is exactly why the terminal on the attacker's screen never so much as stutters.
Of inbound sessions sandboxed before any verdict is formed
Weighted heuristics scoring every live session, continuously
LLM call per session, downstream, and never an actuator
A single-shot injection can finish before cumulative behaviour has moved the score at all. Those are caught synchronously, per request, alongside the continuous score. Each surface below is the same score field with only one tactic's heuristics active. Discovery is wide and shallow. Execution is a narrow spike.
7 rules · peak T1190 w14
5 rules · peak T1552.005 w12
10 rules · peak T1046 w7
4 rules · peak T1098.004 w12
3 rules · peak T1068 w13
4 rules · peak T1041 w12
Four ordered operations, inside one container that stays exactly where it is.
Ordered operations in the sequence. The management network is deliberately not one of them.
docker network disconnect backend_net. The real MySQL, Redis and internal API stop being reachable from inside the session.
New host, fresh PIDs, an empty process tree
uptime, /proc and disk identity all reset
Shell history and dropped files left behind
The TCP/TTY session breaks or has to be re-established
Same container, so PID 412 is still PID 412
uptime, /proc and local state continue uninterrupted
History, cwd and dropped files stay exactly where they were
mgmt_net is never modified, so the live session is never touched
“Relocation is detectable. Continuity is the deception. The attacker keeps the session and quietly loses the world behind it.”
The LLM is strictly downstream. It writes the narrative once the session is over and can never trigger a conversion, a block, or a rule promotion. Logs are attacker-controlled, and a model with the power to act would be prompt injection wired straight into containment.