The Corroboration Engine
Every risk score in SentinelTI comes from a trained ensemble scored against real threat data — not a hand-tuned formula dressed up as ML. Here is exactly what runs, in plain terms, with nothing hidden.
What's genuinely trained
A Random Forest and an XGBoost classifier each learn independently from the same data, then a Logistic Regression meta-learner — trained with real 3-fold cross-validation — decides how much to trust each one. This is scikit-learn's and XGBoost's actual StackingClassifier, calling real .fit() on real labeled rows. Nothing here is simulated.
The training data is real, not synthetic: up to 400 IPs confirmed malicious by AbuseIPDB's global reporting community, plus verified-safe DNS/CDN IPs as the negative class — refreshed on a rolling cache so the model keeps learning from current threat activity, not a frozen snapshot.
Explainability
Every score in SentinelTI ships with the actual shap library's TreeExplainer run directly against the trained Random Forest — the same peer-reviewed, game-theoretic technique banks and insurers use for regulator-facing model explainability. It can only run against a real model object; there is nothing to point it at if the score underneath were fabricated.
That's what produces the baseline/delta numbers and per-feature waterfall you see on every indicator — a mathematically accountable answer to "why did this score HIGH?", not a black-box verdict.
What isn't trained ML — on purpose
Two things in the pipeline are deliberately not the trained model, and SentinelTI says so in the API response rather than folding them in silently:
gn_corroboration_boost: true/false on every response — cross-source agreement a human analyst would apply too, made explicit instead of buried in a model weight.model_ready: false and gone the moment training completes.Every feature, the full training mechanics, and a worked SHAP example — the complete technical deep-dive lives in the docs.