sentora

Sentora Community Edition is a self-hosted security operations platform designed for small and mid-sized teams that lack a dedicated Security Operations Center (SOC). The platform integrates multiple security functions into a single, easy-to-deploy stack, allowing organizations to monitor, detect, and respond to threats effectively. **Telemetry and Detection** The system collects telemetry data from both Windows and Linux agents, which send a variety of security events over a TCP channel. This includes standard SIEM logs, alerts, file-integrity monitoring (FIM), installed packages, network connections, open ports, Docker activity, and even screen frames. The detection mechanism relies on Sigma rules, which are run directly on the endpoint. The repository ships with 43 built-in rules covering 47 MITRE ATT&CK techniques, and these rules carry their own ATT&CK tags, eliminating the need for a separate mapping table. A second layer of detection performs deterministic cross-event correlation to identify patterns like password spraying, brute-force attacks, or bursts of account creation, which can be analyzed both per host and across the entire network. **AI Triage** A key feature of Sentora is its use of artificial intelligence for triage. Three worker processes utilize a locally running Ollama model (defaulting to llama3.2:3b) to analyze incoming events in real-time. The AI can perform deep scans, assess the severity of events, and propose defensive actions. To ensure safety, the system operates in a "shadow mode" where the AI's decisions are staged as proposals for human approval rather than being executed automatically. Furthermore, only a specific safe-list of actions (such as blocking an IP or isolating a host) can be dispatched, and only when the confidence threshold is met. **Search, Assets, and Automation** Events are indexed in OpenSearch, providing a robust search engine for log analysis. The platform also maintains an inventory of hardware, software, and network assets for each agent. The SOAR (Security Orchestration, Automation, and Response) component allows for the creation of visual playbooks that can be triggered manually or by AI verdicts. Additionally, the system includes OSV vulnerability scanning to check for known vulnerabilities in installed packages and integrates with threat-intelligence feeds from abuse.ch to populate a local indicator table. **Deployment and Security** Sentora is deployed as a Docker stack using `docker compose up`, requiring Docker 24+ and Python 3.10+. The README provides detailed sizing profiles for different scales of deployment. Security is a primary concern, with features like server-side sessions using opaque HttpOnly cookies, deny-by-default routing, login throttling, and agent-initiated WebSocket management to prevent inbound attacks. The platform also includes a robust testing suite to ensure that all routes are properly permission-gated.