sentora

Sentora Community Edition is a self-hosted security operations platform aimed at small and mid-sized teams without a dedicated SOC. Its README describes a stack combining SIEM log collection, endpoint detection and response, and SOAR automation, brought up with a single docker compose up. Telemetry and detection: Windows and Linux agents send SIEM events, alerts, file-integrity monitoring (FIM), installed packages, network connections, open ports, Docker activity and screen frames over a TCP channel. Detection runs on the endpoint with Sigma rules - the repository ships 43 built-in rules covering 47 MITRE ATT&CK techniques in conf/sigma/builtin, and rules carry their own ATT&CK tags rather than relying on a hand-maintained mapping table. A second, deterministic layer correlates events across time to find patterns such as password spray, brute force, success arriving after repeated failures, and bursts of account creation or service installs; the README notes this runs at two vantage points, per host on the agent and across hosts in the ingest path. Agent configurations are validated (YAML parse, structural shape, regex compilation) before being pushed to sensors. AI triage: three worker processes use a locally running Ollama model (default llama3.2:3b, swappable in .env) to review incoming events in real time, run operator-initiated deep scans, and decide on defensive actions. A shadow mode (AI_SHADOW_MODE=1) stages autonomous verdicts as proposals for human approval in the SOAR Hub instead of dispatching them. Only a fixed safe-list of actions - including BLOCK_IP, ISOLATE_HOST, KILL_PROCESS, DISABLE_USER, QUARANTINE_FILE and container-level actions - can be auto-dispatched, and only above a configurable confidence threshold; anything else is downgraded to an advisory insight. Search, assets and automation: events are indexed in OpenSearch with a cross-agent log explorer and an optional Kibana-style OpenSearch Dashboards view. A per-agent page exposes hardware, software and network socket inventory, plus AI analysis with verdicts, confidence, IOCs and a link back to the source log row. SOAR playbooks are built in a small visual editor with per-node result tracking and can be triggered manually or by an AI verdict. Agents also have their installed packages scanned against OSV (online or via an internal mirror), and threat-intel feeds from abuse.ch (Feodo, ThreatFox, URLhaus) populate a local indicator table with staleness pruning and an air-gap switch. Deployment: Docker 24+ with Compose v2, plus Python 3.10+ on the host for the one-time agent build. The README lists sizing profiles from a lab of up to 5 agents (4 cores, 12 GB RAM) through to 50+ agents, and gives idle footprints for Ollama, OpenSearch, MySQL and RabbitMQ. Only the app and ingest services listen on all interfaces by default; MySQL, RabbitMQ, Ollama and OpenSearch bind to localhost, and the README warns against exposing them by widening BIND_ADDR. Machine-generated secrets come from scripts/init_secrets.py, TLS certificates are generated per install rather than shipped, and the seeded admin account is created with a must-change-password flag enforced in middleware. Security posture described in the README includes server-side sessions with opaque HttpOnly cookies (only a SHA-256 hash is stored), deny-by-default routing with permission-gated handlers enforced through a middleware registry, per-account and per-IP login throttling counted from existing login logs, X-Forwarded-For honoured only from configured trusted proxies, and agent-initiated WebSocket management so endpoints do not run an inbound management API. A test asserts that every route is permission-gated, listed as public, or explicitly named as session-only with a justification. Operational documentation in the repository covers architecture, production deployment, an update runbook and a progress report.