🛡️ Sentinel-Hub: Multi-Agent AI Forensics Framework

Sentinel-Hub is an autonomous Security Operations Center (SOC) orchestrator built using LangGraph and Gemini 3.1 Flash-Lite. It represents the "Master Brain" that integrates specialized AI models to investigate complex, multi-modal security threats involving financial fraud, infrastructure breaches, and identity theft.

🚀 The Vision

In modern enterprise security, data is siloed. Sentinel-Hub breaks these silos by employing a Multi-Agent System (MAS) where specialized agents collaborate, cross-validate findings, and provide human-aligned risk assessments.

---

🧩 The Three Pillars of Forensic Intelligence

This hub orchestrates three specialized microservices (click to view individual repos):

1. NeuralAudit (SSL/Finance): Detects transactional anomalies using Self-Supervised Learning and Supabase (pgvector).
2. LogSentinel (BERT/Logs): Identifies zero-day infrastructure threats in Zilliz (Milvus) using distilled BERT embeddings.
3. DeepShield (DINOv2/DPO): High-fidelity deepfake detection aligned with human-perceived risk via Direct Preference Optimization (DPO), deployed on Amazon SageMaker.

---

🧠 System Architecture: Multi-Agent Collaborative Flow

graph TD
    Start((User Alert)) --> Triage{Triage Agent}
    
    subgraph Specialists
        Triage -->|Needs Data| Forensics[Forensic Specialist]
        Triage -->|Needs Context| Researcher[Threat Intel Agent]
    end
    
    Forensics -->|Findings| Triage
    Researcher -->|Findings| Triage
    
    Triage -->|Everything Ready| CISO{CISO Reviewer}
    
    CISO -->|Rejected| Triage
    CISO -->|Approved| End((Final Security Brief))
    
    Triage -.->|Max Iterations| Emergency[Emergency Finalizer]
    Emergency --> End

Loading

---

🛠️ Technical Stack

• Orchestration: LangGraph (Stateful Cyclic Graphs)
• LLM Brain: Google Gemini 3.1 Flash-Lite (High-speed reasoning)
• Web Intel: Tavily Search API
• Vector Infrastructure: Zilliz (Milvus), Supabase (PostgreSQL/pgvector)
• Inference: Amazon SageMaker (Docker/Containerized)
• Frontend: Streamlit

⚡ Key Engineering Features

• Dynamic Entity Extraction: The Triage agent automatically identifies User IDs and geographic regions to parameterize downstream tool calls.
• Cyclic Self-Correction: The CISO node acts as a quality gate, forcing re-investigation if evidence is insufficient.
• Deadlock Prevention: Implemented state-based iteration tracking to prevent infinite agentic loops.

📦 Installation & Setup

1. Clone the Hub: git clone https://github.com/TorshaMajumder/Sentinel-Hub-MAS.git
2. Install Dependencies: pip install -r requirements.txt
3. Configure: Rename config.json.example to config.json and add your API keys.
4. Launch the Command Center: streamlit run app.py

---

🚀 Live Demo

streamlit-app.webm

---