SentinelTI Documentation

Real-time threat intelligence. ML-scored. MITRE-mapped. SIEM-ready.

Overview

SentinelTI is a production-ready, multi-tenant Threat Intelligence Platform (TIP) that aggregates Indicators of Compromise (IOCs) from open-source threat feeds, enriches them through a 5-layer intelligence pipeline, scores them with a machine learning ensemble, maps them to MITRE ATT&CK, and pushes actionable alerts to your SIEM — all inside a modern dashboard.

Built as a serious open-source alternative to commercial TIPs like ThreatConnect and Anomali.

Getting Started

SentinelTI is a hosted platform — there's nothing to install or run locally. Three steps from zero to your first scored indicator:

1. Create a free workspace

No card required. Register with a work email — you get an isolated tenant instantly, on the Free plan (50 IOCs/fetch, 500 stored).

2. Fetch your first threat feeds

Click FETCH in the dashboard's command bar. SentinelTI pulls from 9 OSINT feeds in parallel — enrichment and ML scoring run automatically in the background, and the Offense Queue updates in real time.

3. Explore the score

Open any HIGH-risk indicator and check the SHAP Explainability and MITRE ATT&CK pages — every score ships with the evidence behind it, not just a verdict.

Architecture

┌──────────────────────────────────────────────────────────────┐
│                    SENTINELTI PLATFORM                       │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │              Next.js 14 Frontend                       │  │
│  │  /dashboard /intel /lookup /scoring /shap /mitre       │  │
│  │  /alerts    /siem  /analytics        /integrations     │  │
│  └─────────────────────────┬──────────────────────────────┘  │
│                            │  REST API (Bearer token)        │
│  ┌─────────────────────────▼──────────────────────────────┐  │
│  │              FastAPI Backend                            │  │
│  │  Auth · Feeds · Enrichment · ML · MITRE                │  │
│  │  Alerts · SIEM · Export · Import                       │  │
│  └─────────────────────────┬──────────────────────────────┘  │
│                            │                                  │
│  ┌─────────────────────────▼──────────────────────────────┐  │
│  │  MongoDB — indicators · users · tenants · alerts        │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

External feeds:    Abuse.ch · CINS Army · OTX · Feodo · ET
Enrichment APIs:   VirusTotal · AbuseIPDB · ipinfo · GreyNoise · URLhaus
SIEM targets:      Splunk HEC  ·  Elasticsearch

Tech Stack

Offense Queue

Threat Intel

IP Lookup

ML Risk Engine

SHAP Explainability

MITRE ATT&CK

Analytics

Alert Rules

SIEM Export

Integrations

Feed Sources

Enrichment Pipeline

Every IOC runs through 5 sequential enrichment stages in a background thread, isolated per tenant. The score is boosted at each stage when signals confirm malicious behaviour.

Score boosting rules

Risk Score Reference

Model Architecture

SentinelTI uses a stacking ensemble — two independent base learners whose probability outputs are combined by a linear meta-learner. This consistently outperforms any single model on threat scoring tasks.

Base layer:   Random Forest   (100 trees · max_depth=8)
              XGBoost        (150 rounds · lr=0.05 · depth=6)
                              ↓   predictions stacked as features
Meta layer:   Linear Regressor
                              ↓
Output:       Continuous score  0.0 – 1.0  →  scaled to 0 – 10
              Bucketed:         HIGH (≥9)  ·  MEDIUM (5–8)  ·  LOW (<5)

Feature Engineering

SHAP Explainability

SHAP (SHapley Additive exPlanations) decomposes each model prediction into per-feature contributions, so every risk score comes with a plain-language explanation of why it was assigned.

MITRE Mapping Logic

Each IOC is automatically tagged with ATT&CK tactics during enrichment Stage 4. Multiple tactics can be assigned to one IOC.

Tactic Reference

Authentication

All protected endpoints require the header Authorization: Bearer <access_token>. Tokens are issued on login and valid for 30 minutes.

SSO / SAML

MSSP-tier tenants can require single sign-on for their domain. Discovery and callback are unauthenticated (a user hasn’t logged in yet); config is admin-only. SAML assertions are explicitly rejected rather than silently unverified — only OIDC providers (Okta, Azure AD, Google Workspace) perform real ID-token verification (JWKS fetch, signature/audience/issuer checks) today.

Indicators

ML & SHAP

MITRE ATT&CK

Threat Actor Attribution

Measures TTP overlap between tenant IOCs and the published tradecraft of catalogued threat groups, weighted by how discriminating each technique is (widely-shared techniques like T1071 count for little; named tooling counts heavily). This is a similarity signal, not attribution — the API and UI both surface it as an evidence bundle with a qualitative band, never a confidence percentage.

Alerts

SIEM

TAXII / STIX

A native TAXII 2.1 server and a plain STIX 2.1 bundle endpoint, for consumers that pull rather than receive a push — firewalls (Palo Alto EDL, Fortinet), SIEMs with a native TAXII connector, and SOAR platforms. Both authenticate the same way as the Export API: a Bearer token or an ?api_key= query param.

MSSP Client Workspaces

Lets one MSSP-tier tenant manage unlimited client sub-tenants: enroll, create, list, soft-delete, and switch context into a client workspace. Switching mints a token pair whose tenant_id claim is the client’s — the entire rest of the API becomes client-scoped for free, with the parent/child relationship re-verified live on every request rather than only at token-mint time.

Audit Log

A tamper-evident, append-only record of authentication events, mutations, and reads of sensitive data (exports/pulls) — never routine paginated /indicators views, which is analytics, not audit. Every entry is chained: each stores seq, prev_hash, and entry_hash (a SHA-256 of the previous entry’s hash plus this entry’s own canonical content), per tenant. There is no update or arbitrary delete path on this collection anywhere in the codebase — the only way entries disappear is the bounded retention prune below, which checkpoints the last-deleted entry’s hash first so the surviving chain still roots in real history.

Import & Export

curl -X POST "https://sentineltibackend-production.up.railway.app/import/webhook/<your_token>" \
  -H "Content-Type: application/json" \
  -d '[{"indicator":"1.2.3.4","sources":"splunk-export","risk":"HIGH","country":"CN"}]'

HTTP error codes

All errors return: { "detail": "error message" }

Docker Compose

The easiest way to run the full stack locally — backend, frontend, and MongoDB in one command.

cd sentinel_TI_product
cp backend/env.sample backend/.env
# Edit backend/.env

docker-compose up --build

Railway

Both backend/railway.json and sentinelti-next/railway.json are preconfigured. Connect your repository in Railway, set the environment variables below, and deploy each service independently.

Vercel

Deploy the Next.js frontend to Vercel for the best edge performance. The backend stays on Railway or Docker.

# In the Vercel dashboard
# Root directory: sentinelti-next
# Framework: Next.js
# Environment variable: NEXT_PUBLIC_API_URL = https://your-backend.up.railway.app

Environment Variables