sentora

Sentora Community Edition is a self-hosted security operations platform designed for small and mid-sized teams without a dedicated SOC. It integrates SIEM log collection, endpoint detection and response, and SOAR automation into a single stack that can be deployed with a simple docker compose up command. Telemetry and detection are handled by Windows and Linux agents that send various data types (SIEM events, FIM, network connections, etc.) over a TCP channel. The platform uses Sigma rules for detection, with 43 built-in rules covering 47 MITRE ATT&CK techniques. A deterministic correlation layer identifies patterns like password sprays and brute force attacks, running both on individual hosts and across the entire ingest path. AI triage is performed by three worker processes using a local Ollama model (default llama3.2:3b). These workers review incoming events in real-time, run deep scans, and decide on defensive actions. A shadow mode allows for human approval of autonomous verdicts before they are dispatched. Only a fixed list of safe actions can be auto-dispatched, and only above a configurable confidence threshold. The platform includes a search engine (OpenSearch) for log exploration, a per-agent asset page for inventory and analysis, and a visual editor for SOAR playbooks. It also features OSV vulnerability scanning and integration with threat-intel feeds from abuse.ch. Deployment requires Docker 24+ with Compose v2 and Python 3.10+. The README provides sizing profiles for different numbers of agents and warns against exposing certain services (MySQL, RabbitMQ, Ollama, OpenSearch) by widening BIND_ADDR. Security measures include server-side sessions with opaque cookies, deny-by-default routing, login throttling, and agent-initiated WebSocket management.