Every session sandboxed, continuously scored, and converted in place . They keep the session, and lose the world behind it.
The score decays. Evidence has to keep arriving.
Ten layers, L0 ingress through L9 console
A session's score is a point moving over a field of weighted behavioural evidence. Early on the field is noise, because nothing has converged and nothing should. As recon turns into enumeration and enumeration into exploitation, the surface deepens into a basin, and the trajectory falls into it.
$ cat /etc/passwdBroadband noise, no basin. Weak passive priors only: GeoIP, JA4, HASSH, reputation. None of it is a verdict.
$ grep -rIl 'PASSWORD\|SECRET' /srv /optEvidence accumulating faster than it decays. A minimum is forming, but the session keeps full backend reachability.
$ cat /etc/shadowThe basin is decisive and the trajectory has crossed T. Conversion fires, and scoring carries on afterwards.
Live from the running gateway, not a recording. Every command typed into the newest SSH session lands here within about a second, with what it added to the session's score and the running total after it. Watch the right-hand column when the score crosses T: the backend swaps beneath the session, and nothing about the session does.
Same container, real internal services. Nothing has crossed the threshold yet.
Relocation leaks. ls, uptime, /proc, the process tree, the files they already dropped: any one of them gives away the move to a honeypot. Staying put is the deception.
Every inbound session is containerised before anything is known about it. The safe boundary is not something switched on once a connection starts to look bad.
A session counts as converted only once Docker reports exactly the two deception networks, both internal, and a probe from inside finds no default route, no outbound TCP and no outside DNS. Anything short of that leaves it cut off from every network, never back on the real one.
The same shell process, either side of conversion
Backend reachability
At threshold Tevery network detached, deception_net and imds_net attached, container untouched
Real backends reachable after conversion
NONENothing about the attacker's local state changes. The shell reaches the container through the Docker API, not over a container network, so swapping every network under it never drops the live SSH session.
Everything else is identical either side: PID 412 bash and PID 431 curl are the same processes, cwd is still /home/deploy, shell history, env vars, dropped files and uptime in /proc all read exactly as they did a second earlier.
Each of these had a live session doing observable things inside someone's network. The left column is public post-incident reporting. The right is what this design is built to do against the same behaviour.
A server-side request forgery reached the cloud metadata service, and the credentials it returned were real.
The request still succeeds. What comes back is fabricated, and what leaves is nothing.
SentinelX does not fix the WAF misconfiguration that made the SSRF reachable. It changes what the SSRF is worth. In this build it also would not notice it: the SSRF and metadata-request heuristics are designed, not built, the only request check is for path traversal, and the application would have to run inside the session's container for HTTP to reach it at all.
Design claims, not measured results. SentinelX does not patch vulnerabilities and would not have prevented these breaches. It contains the session that exploits one, and keeps the record. Each case states where it would not have helped.
Read the threat modelContainerise first, decide later. Conversion only works because the session already lives somewhere controllable. We never wait to identify an attacker before building the box.
Suspicious evidence raises the score; time and benign behaviour lower it again. Cumulative scoring catches the slow campaign, synchronous request checks catch the single shot.
Three ordered steps, all run from outside the container: detach every network, attach the deception side, verify. The shell never rode a network, which is exactly why the terminal on the attacker's screen never so much as stutters.
Of inbound sessions sandboxed before any verdict is formed
Weighted heuristics scoring every live session in this build, of about thirty designed
Model calls anywhere a session is scored, contained or converted
A single-shot injection can finish before cumulative behaviour has moved the score at all. Those are caught synchronously, per request, alongside the continuous score. Each surface below is the same score field with only one tactic's heuristics active. Discovery is wide and shallow. Execution is a narrow spike.
7 rules · peak T1190 w14
5 rules · peak T1552.005 w12
10 rules · peak T1046 w7
4 rules · peak T1098.004 w12
3 rules · peak T1068 w13
4 rules · peak T1041 w12
Three ordered steps, run from outside one container that stays exactly where it is.
Ordered steps in the sequence. Nothing runs inside the attacker's container to make them hold.
Every network the container is on is disconnected, backend_net and anything attached out of band. From here the session can reach nothing, so a failure at any later step leaves it cut off, never back on the real backend.
New host, fresh PIDs, an empty process tree
uptime, /proc and disk identity all reset
Shell history and dropped files left behind
The TCP/TTY session breaks or has to be re-established
Same container, so PID 412 is still PID 412
uptime, /proc and local state continue uninterrupted
History, cwd and dropped files stay exactly where they were
The shell rides the Docker API, not a network, so the live session is never touched
“Relocation is detectable. Continuity is the deception. The attacker keeps the session and quietly loses the world behind it.”
The narrative is strictly downstream. It is written once the session is over and can never trigger a conversion, a block, or a rule promotion. In this build it is a fixed template; the design allows one model call there and nowhere else, because logs are attacker-controlled and a model with the power to act would be prompt injection wired straight into containment.