SentinelTI User Guide

SentinelTI is a Threat Intelligence Platform (TIP) — a cybersecurity tool that automatically collects, enriches, scores, and presents information about malicious IP addresses and other online threats.

Think of it as a radar for cyber threats. Every day, thousands of malicious IPs are identified and published by security researchers around the world. SentinelTI pulls all of that data into one place, runs it through multiple intelligence sources, applies a machine-learning model to rank the danger level, and shows you a clean, actionable dashboard so your security team can respond fast.

A sentinel is a soldier stationed at the entrance to a camp or city, watching the horizon and sounding the alarm if an enemy approached. They do not wait for the enemy to arrive — they watch constantly, so that others can act in time.

The name is deliberate on three levels:

• ▸Vigilance — SentinelTI never sleeps. It continuously fetches threat feeds, enriches indicators, and monitors your environment.
• ▸Warning — Like a sentinel raising the alarm, SentinelTI fires alert webhooks the moment it detects a high-risk IOC matching your rules.
• ▸Context — A good sentinel doesn't just shout "danger!" — it tells you where the threat is, what it is, and why it's dangerous. SentinelTI does this through ML scoring, SHAP explanations, and MITRE ATT&CK mapping.

▸Step 1 — Register

Go to the SentinelTI URL and click Register. Fill in your email, password (min 8 chars, must differ from your email), full name, and your organisation name. Each organisation gets a fully isolated tenant workspace.

▸Step 2 — Log In

Enter your email and password. You land directly on the Offense Queue dashboard.

▸Step 3 — Fetch Your First Threat Feeds

In the Command Bar at the top, select an IOC count (25–200) and click FETCH. The system pulls from all configured threat feeds and begins enriching in the background. Watch the KPI strip update in real time.

▸Step 4 — Run ML Scoring

After enrichment completes, click SCORE. The ML stacking ensemble (Random Forest + XGBoost) assigns a risk score to every IOC. The ML SCORED counter in the KPI strip will update.

Every page shares the same three-layer shell:

┌──────────────────────────────────────────────────────────────┐
│  TOP BAR  — Tenant name · Status dot · UTC+IST clock         │
│             DARK/LIGHT toggle · DOCS button                  │
├──────────────────────────────────────────────────────────────┤
│  KPI STRIP  — TOTAL · HIGH · MEDIUM · LOW · ENRICHED · ML   │
├──────────────────────────────────────────────────────────────┤
│  COMMAND BAR  — IOC limit · FETCH · SCORE · CLEAR ·          │
│                REFRESH · EMAIL REPORT                         │
├──────────┬───────────────────────────────────────────────────┤
│          │                                                    │
│ SIDEBAR  │            PAGE CONTENT                           │
│ Nav menu │         (changes per page)                        │
│          │                                                    │
└──────────┴───────────────────────────────────────────────────┘

▸KPI Strip — Always Visible

▸System Status Dot

Visible on every dashboard page. Your primary control panel.

▸ML Score (0.0000 – 1.0000)

After running SCORE, each IOC gets a precise 4-decimal probability from the stacking ensemble:

▸Asset-Aware Badges

If you have registered IP ranges in the Asset Registry, two additional badge types appear:

▸Why Two Risk Columns on the Table?

When you click FETCH, each IOC goes through 5 sequential stages automatically:

▸Enrichment API Limits & Costs

SentinelTI uses six external enrichment APIs. All are free-tier or key-optional — here’s what each provides and what paid tiers unlock:

MSSP customers can request BYOK (Bring Your Own Key) enrichment — supply your own VirusTotal or GreyNoise API key for richer enrichment without rate-limit sharing. Contact sohamshahh@gmail.com to enable this.

This section explains the full machine-learning pipeline — from raw enrichment data to the score you see on screen.

▸The Architecture

Raw IOC features (11 numbers)
        │
        ├─────────────────────────────┐
        ▼                             ▼
Random Forest (50 trees)        XGBoost (50 rounds)
  max_depth = 6                   max_depth = 4, lr = 0.05
  rf_prob = P(malicious)          xgb_prob = P(malicious)
        │                             │
        └──────────┬──────────────────┘
                   ▼
        [rf_prob, xgb_prob] → Logistic Regression (meta)
                   │
                   ▼
        ml_score  (0.0000 – 1.0000)
                   │
        GreyNoise corroboration boost (+0.10 if gn_classification = "malicious")
                   │
                   ▼
        final_score  ≥ 0.70 → HIGH  |  0.30–0.69 → MEDIUM  |  < 0.30 → LOW

▸The 11 Features

▸GreyNoise Corroboration Boost

When both AbuseIPDB and GreyNoise independently flag an IP as malicious, the agreement across two completely separate intelligence networks is a strong signal that should be reflected in the final score.

SentinelTI applies a +0.10 corroboration boost to the raw ML score whenevergn_classification == "malicious". This boost applies to all three output values:ml_score, rf_prob, and xgb_prob. The final score is always clamped to [0.0, 1.0].

# Example: AbuseIPDB = HIGH confidence + GreyNoise = malicious

Without boost:
  ml_score = 0.82 → HIGH
  gn_classification = "malicious"

With boost applied:
  ml_score = min(0.82 + 0.10, 1.0) = 0.92 → HIGH (stronger)
  gn_corroboration_boost = true  ← returned in API response

The boost only fires when GreyNoise actively classifies the IP as malicious — it does not fire for unknown or benign (RIOT) classifications. A GreyNoise 404 or rate-limit response leaves the score unchanged.

▸How Random Forest Works

A Random Forest is an ensemble of 50 decision trees. Each tree is trained on a random subset of the training data and at each split considers only a random subset of the 10 features. The trees vote independently — the RF outputs the fraction of trees that voted "malicious" (rf_prob).

Two sources of randomness (random data subsets + random feature subsets) prevent overfitting and make the ensemble robust to noisy signals. With max_depth=6, each tree can learn complex feature interactions.

Features:  abuse_reports=142, recency_hrs=2.3, confidence_pct=89.5,
           vt_detections=12, multi_source=1.0, freshness=0.997 …

Tree  1:  "abuse_reports > 20?  YES → vt_detections > 5?   YES → MALICIOUS ✓"
Tree  2:  "multi_source == 1?   YES → confidence_pct > 60?  YES → MALICIOUS ✓"
Tree  3:  "freshness > 0.8?     YES → abuse_reports > 50?   YES → MALICIOUS ✓"
Tree  4:  "recency_hrs < 24?    YES → vt_detections > 3?    YES → MALICIOUS ✓"
Tree  5:  "confidence_pct > 80? YES → multi_source == 1?    YES → MALICIOUS ✓"
  ...  (trees 6–47 each learned different rules, all vote MALICIOUS)  ...
Tree 48:  "abuse_reports > 100? YES → freshness > 0.9?      YES → MALICIOUS ✓"
Tree 49:  "geo_risk == 0?       YES → recency_hrs < 5?      NO  → BENIGN    ✗"
Tree 50:  "vt_detections > 10?  YES → confidence_pct > 70?  YES → MALICIOUS ✓"

Vote tally:  48 MALICIOUS  vs  2 BENIGN
rf_prob = 48 / 50 = 0.96

▸How XGBoost Works

XGBoost is a sequential boosting ensemble — unlike RF (parallel trees), it builds 50 trees one after another, each correcting the errors of the previous trees. A low learning rate (0.05) means each tree contributes only 5% of its prediction, preventing any single tree from dominating.

RF and XGBoost make their errors in different places, so combining them through stacking consistently outperforms either model alone.

▸How Stacking (the Meta-Learner) Works

Instead of simple averaging, a Logistic Regression learns the optimal combination of RF and XGBoost outputs using 3-fold cross-validation. It learns weights β₁ and β₂ such that:

ml_score = sigmoid(β₀ + β₁ × rf_prob + β₂ × xgb_prob)

If RF is more reliable on your data → β₁ > β₂ (meta-learner adapts automatically)

▸Training Data — Real AbuseIPDB

The model is trained on real labeled threat data from AbuseIPDB, not synthetic samples. On first startup, SentinelTI fetches up to 400 confirmed malicious IPs from the AbuseIPDB blacklist (confidence ≥ 50%) and verifies a set of known-safe DNS/CDN IPs as the negative class. The resulting dataset is cached for 7 days so training is fast on every restart.

▸Example — Full Walkthrough (with GreyNoise Corroboration)

IP: 185.220.101.42 (after enrichment)

Features (11):
  abuse_reports     = 142     (from AbuseIPDB)
  recency_hrs       = 2.3     (reported 2.3 hours ago)
  confidence_pct    = 89.5    (89.5% confidence)
  vt_detections     = 12      (12 AV engines flagged it)
  vt_total          = 87      (87 engines checked)
  multi_source      = 1.0     (in Feodo + OTX)
  attack_type_count = 3.0     (SSH + web + port scan)
  geo_risk          = 0.0     (Germany — not in high-risk set)
  freshness         = 0.997   (seen 2.3h ago)
  source_score      = 0.5     (Feodo base score 5 → /10)
  gn_malicious      = 1.0     (GreyNoise: classification = "malicious")

ML Scoring:
  rf_prob  = 0.9400   (47/50 trees voted malicious)
  xgb_prob = 0.9100   (boosted trees strongly agree)
  ml_score = 0.9412   (stacking meta-learner output)

GreyNoise corroboration boost (+0.10, capped at 1.0):
  ml_score → min(0.9412 + 0.10, 1.0) = 1.0000 → HIGH (corroborated)
  gn_corroboration_boost = true

SHAP (why HIGH?):
  Base value:       0.45
  + abuse_reports:  ▲ +0.28   (142 reports — very strong)
  + confidence_pct: ▲ +0.15   (89.5% AbuseIPDB confidence)
  + freshness:      ▲ +0.07   (seen 2.3h ago)
  + vt_detections:  ▲ +0.06   (12 detections)
  + multi_source:   ▲ +0.05   (two independent sources)
  + gn_malicious:   ▲ +0.10   (GreyNoise corroboration boost)
  - geo_risk:       ▼ -0.03   (Germany — slightly reduces score)
                    ──────
  Final:            1.0000 → HIGH (corroborated by GreyNoise)

SentinelTI can deliver enriched threat intelligence to your SIEM in two modes — push (SentinelTI sends data to your SIEM after every FETCH) and pull(your SIEM polls SentinelTI's export API on a schedule). Both are available from the SIEM and Integrations pages.

▸11.1 Export API Key — Pull Mode

The pull model is the industry-standard integration pattern. Your SIEM polls SentinelTI's export endpoint on a schedule and retrieves the latest enriched IOCs. No inbound firewall rules needed on your SIEM side.

Getting your API Key: Go to Integrations in the sidebar → scroll to the Export API Key card → click SHOW → copy. Your pre-built pull URL is shown below the key.

https://sentineltibackend-production.up.railway.app/export/iocs?api_key=<YOUR_KEY>&risk=HIGH,MEDIUM&limit=500

If your key is compromised, click Rotate Key on the Integrations page — the old key stops working immediately.

▸11.2 DNIF Hypercloud — Full Integration Guide

DNIF is the recommended SIEM for SentinelTI. This section covers the complete end-to-end setup — push (SentinelTI → DNIF after every FETCH), pull (DNIF polls SentinelTI on a schedule), and correlation Signal creation. For push credentials only, see the quick-reference in Section 11.3.3.

▸Step 1 — Create the HTTP Connector in DNIF

In DNIF Hypercloud: Connectors → Add Connector → HTTP Connector. Name it SentinelTI. Once created, copy the Collector URL and Bearer Token — you will need these in Step 2.

▸Step 2 — Configure Push in SentinelTI

In SentinelTI: SIEM page → DNIF tab → paste the Collector URL and Bearer Token → set minimum risk tier (HIGH recommended) → enable Auto-push → click Test → click Save. After every FETCH, HIGH/MEDIUM IOCs are automatically pushed to DNIF.

▸Step 3 — Configure Pull in DNIF

In DNIF, configure the HTTP Connector to also poll SentinelTI's export endpoint every hour. Use the pull URL from the Integrations page:

https://sentineltibackend-production.up.railway.app/export/iocs?api_key=<YOUR_KEY>&risk=HIGH,MEDIUM&limit=500

Set polling interval to 3600 seconds (1 hour) to match SentinelTI's enrichment cycle.

▸Step 4 — Create a DNIF Correlation Signal

Once IOCs flow into DNIF, create a Signal that fires whenever a network log matches a SentinelTI HIGH IOC:

▸11.3 Push Mode — All 7 SIEMs

SentinelTI can push enriched IOCs directly to seven SIEMs via their native APIs. Go to SIEM in the sidebar, pick the SIEM tab, fill in credentials, test, then save. After every FETCH, HIGH/MEDIUM IOCs are pushed automatically.

▸11.3.1 Splunk HEC

Splunk Web → Settings → Data Inputs → HTTP Event Collector → New Token → name it SentinelTI → copy token.

index=sentinel-ti sourcetype=sentinel_ti:ioc severity=HIGH
| table src_ip, sentinel_risk_score, malware_family, geo_country

▸11.3.2 Elasticsearch / Elastic SIEM

Kibana → Stack Management → API Keys → Create API Key with write access to your target index.

SentinelTI uses the Elasticsearch Bulk API (/_bulk). Each IOC is a JSON document with @timestamp.

▸11.3.3 DNIF Hypercloud — Push Credentials

▸11.3.4 Microsoft Sentinel

You need a Data Collection Rule (DCR), a Data Collection Endpoint (DCE), and an Azure AD app token.

▸11.3.5 IBM QRadar

QRadar Admin → Authorized Services → Add Authorized Service → name SentinelTI → role Admin → copy the SEC token (UUID).

▸11.3.6 Sumo Logic

Sumo Logic → Manage Data → Collection → Add Collector → Hosted Collector → Add Source → HTTP Logs & Metrics. The Source URL is both the endpoint and the authentication — no separate token.

▸11.3.7 Datadog

Datadog → Organization Settings → API Keys → New Key → name SentinelTI → copy the key. No URL needed — SentinelTI always sends to Datadog's fixed log intake endpoint.

source:SentinelTI @severity:HIGH

▸11.4 Real-Time Alerts to SIEM via Alert Rules

Alert Rules can push a single IOC to DNIF the moment it's detected — without waiting for the next batch push. Go to Alerts → create a rule → add a DNIF channel → enter the Collector URL and Bearer Token. When the rule fires, DNIF receives the event within seconds.

▸11.5 Compatible SIEMs — Quick Reference

The Asset Registry solves a real problem in threat intelligence: reputation-based scoring breaks for private IP ranges. When SentinelTI sees 192.168.1.100 in a threat feed, it has no way to know if that IP belongs to an attacker or to your own infrastructure — unless you tell it.

▸12.1 The Problem It Solves

▸12.2 How to Register a Range

Go to Asset Registry in the sidebar.

▸12.3 How It Works in the Dashboard

After every FETCH + SCORE cycle, each IP is checked against your registered CIDRs:

▸12.4 Automatic Compromised Asset Alerts

You do not need to create an alert rule for this — SentinelTI fires automatically. Every time FETCH + SCORE completes, the system checks for COMPROMISED IOCs and dispatches to all channels configured across your active alert rules (Slack, Teams, PagerDuty, email).

▸12.6 Common Enterprise Ranges

SentinelTI is built for SOC teams. Each organisation has a single shared workspace (tenant) — all members see the same IOC database, alerts, and SIEM configuration. The admin controls who can access the workspace.

▸12.1 Roles

▸12.2 Inviting Team Members

Only admins can invite new members. Go to Team in the sidebar → click + Invite Member → enter the work email and select a role → click Send Invite.

SentinelTI emails the invitee with a one-click join link. They set their name and password and automatically join your workspace — no new tenant is created.

▸12.3 The Invite Link

https://sentinelti-product.vercel.app/register?invite=<token>

The token is single-use — once accepted it is invalidated. You can revoke a pending invite from the Team page's Pending Invites section at any time before the invitee clicks it.

▸12.4 Removing Members

Go to Team → find the member → click the ✕ next to their name → confirm. Removed members lose access immediately — their JWT tokens fail on the next request. You cannot remove yourself; invite the new admin first, then have them remove you.

▸12.5 Pending Invites

The Team page (admin view only) lists all pending invites with the invitee email, creation date, assigned role, and a Revoke button to cancel before the link is used.

▸Tenant Isolation — Your Data Stays Yours

SentinelTI is a multi-tenant platform. Every organisation that registers gets a completely isolated workspace — no data is ever shared between accounts.

SentinelTI offers three plans. Every account starts on Free (Starter) automatically — no credit card required. Upgrade any time to unlock higher IOC limits, more users, and advanced features.

▸Support SLA

Every plan includes support, with response times that scale by plan level. See Support & SLA below for the full table.

SentinelTI includes AI-powered support for all plans, with guaranteed human response SLAs that scale with your plan. Visit /support to access the chatbot or submit a request.

▸AI Support Chatbot

The AI assistant at /support is powered by Groq (openai/gpt-oss-120b) and has full context about SentinelTI — features, troubleshooting, SIEM integration, enrichment, plans, and pricing. It provides instant answers 24/7, free for all plans.

If the AI cannot resolve your issue, you can escalate to human support via the “Escalate” button on the support page.

▸Response SLA by Plan

▸Contacting Support

For all enquiries: sohamshahh@gmail.com. Include your tenant name, plan, and a description of the issue. MSSP customers should mark urgent issues with [URGENT] in the subject line for priority handling.