SentinelX

Tenlayers,oneeventlog.

Traffic enters at L0 and never touches production. Everything after that is observation, and one irreversible decision at L4. Each layer writes to the same ordered event store, which is what makes the console a view of the system rather than a reconstruction of it.

The path a session takes

Left to right is time. The only branch in the whole diagram is the threshold. Everything before it happens to every session, attacker or not.

Every layer, and what it is responsible for

Status is how far each layer has actually been taken. The architecture is complete, the implementation is not, and those are not the same claim.

L0

Ingress and passive fingerprinting

Accept inbound traffic, read weak pre-handshake signals, set a prior, and never reject on the prior alone.

Prototyped
L1

Universal sandboxing

Put every inbound session in its own container, before anything is known about it.

Prototyped
L2

Continuous behavioural scoring

Watch the session, accumulate weighted evidence, decay it over time, and check each request synchronously.

In build
L3

Case assembly

Cluster loose signals into one coherent session case with an evidence chain and a timeline.

Designed
L4

In-place deception conversion

At threshold, swap the reachable world beneath a live session without touching the session.

In build
L5

Intelligence collection

Record what the attacker actually did, in enough fidelity to replay and to extract from.

Designed
L6

Extraction and narrative

Map the record to ATT&CK, IoCs and signature candidates deterministically, then make exactly one LLM call for the prose.

Designed
L7

Cross-session correlation

Cluster related sessions by fingerprint similarity and TTP-sequence distance. Not attribution.

Designed
L8

Feedback gate and rule governance

Shadow-test candidate rules against recorded benign traffic, then require a human before anything enforces.

Designed
L9

Console

Show live sessions, the attack story, replay, the environment transition, and the intelligence that came out.

In build

Event-first, or none of the rest works.

The schema was frozen before the console existed. Every layer emits the same record shape into one ordered log, so live monitoring, investigation and replay are three views of one stream rather than three integrations.

The conversion record
{
  "type": "DECEPTION_CONVERSION",
  "phase": "DECEPTION",
  "risk_before": 97.5,
  "risk_after": 97.5,
  "reached_by": "threshold",
  "trigger": "T1003.008 · /etc/shadow read",
  "network_before": [
    "mgmt_net",
    "backend_net"
  ],
  "network_after": [
    "mgmt_net",
    "deception_net"
  ],
  "secrets_unmounted": true,
  "egress_policy": "default-deny"
}

The record every layer writes. risk_before, risk_delta and risk_after are carried on the event itself, so the curve in the console is read from the log rather than recomputed from it.

The live path
  1. Every layerwrites one record shape
  2. Redis Streamsordered, in memory
  3. Postgresdurable, replayable
  4. WebSocket / SSEpushed to the console
  5. Reacttimeline · risk · replay · environment
Why it is frozen

One Pydantic definition for every inter-layer message, settled before the console existed. Without it each component invents its own event format and the timeline has to be reassembled from logs afterwards, which is exactly the reconstruction this design refuses to do.