Enterprise-grade log management and security analytics platform designed for real-time threat detection, compliance reporting, and advanced forensic investigation. Engineered for enterprises, governments, and critical infrastructure operators.
🚀 Quick Start · 📊 Core Features · 🏗️ Architecture · 🔍 Detection Engines · 🛠️ Tech Stack · 📈 Capabilities
Security logs are often ignored, missed, or overwhelming. Organizations collect massive volumes of log data but lack the intelligence to detect actual threats in real-time. This leads to:
- Missed security incidents due to alert fatigue
- Delayed incident response from manual log analysis
- Compliance failures from inadequate audit trails
- Wasted resources parsing through noise
LogSentinel Pro solves this by automatically detecting anomalies in logs through:
- ✅ Real-time log ingestion from multiple sources
- ✅ Intelligent anomaly detection (ML + heuristics)
- ✅ Automatic alert distribution (Email, SMTP, SendGrid, Telegram)
- ✅ Compliance reporting (SOC2, HIPAA, PCI-DSS, GDPR)
- ✅ Forensic investigation tools with attack timelines
- Security Administrators — Real-time threat detection
- Security Operations Centers (SOC) — Enterprise monitoring
- Compliance Officers — Automated compliance reporting
- Incident Response Teams — Forensic investigation
LogSentinel Pro is a next-generation security operations framework — not just a log parser. It features advanced anomaly detection via machine learning, multi-protocol alert distribution (Email/SMTP/SendGrid/Telegram), global threat intelligence correlation, comprehensive compliance frameworks (SOC2, HIPAA, PCI-DSS, GDPR), and military-grade PDF forensic reporting with integrated attack simulation capabilities.
Built with 💙 for Enterprise Security — Deployed in Production Since April 6, 2026 · 1:00 PM
Real-time threat detection with live metrics, event stream, and threat correlation:
- Threat Level Visualization — Live threat score (0-100)
- Event Metrics — Parsed events, threats detected, severity breakdown
- Live Log Stream — Real-time log ingestion with threat highlighting
- Detected Threats Table — Severity, type, MITRE ATT&CK mapping, details
LogSentinel Pro monitoring 100+ threat events with real-time detection
Secure administrative interface with license management and command center:
- Authentication — Role-based access control (Admin authentication required)
- License Management — Generate, track, and manage sensor licenses
- Admin Command Center — Generate OMG, patch counts, stats, audit logs
- Security Notice — Unauthorized access logging and prevention
Admin dashboard with license key generation and command center
AI-powered threat analysis with real-time incident correlation:
- Telemetry Analysis — Failed login attempts, brute force detection
- Incident Correlation — MITRE ATT&CK framework mapping (T1110.001, T1548.003)
- Actionable Alerts — Block IP, investigate, or mark as false positive
- SIEM Integration — LogSentinel Pro threat tickets auto-created
Zeta bot detecting brute force attack (10.0.0.66) with MITRE mapping
Full attack chain detection across 7 cyber kill chain phases:
- 183 Critical Threats Detected — High-severity events across network
- Top Attackers — IP-based threat actor tracking
- Attack Types — Port scanning, privilege escalation, data exfiltration
- Attack Simulation — Complete cyber kill chain (all 7 phases)
LogSentinel Pro detecting and simulating full ransomware attack chain
- ✅ Log Ingestion — Accept logs from syslog, files, APIs
- ✅ Real-Time Alerting — Detect and notify on anomalies
- ✅ Multi-Channel Distribution — Email, SMTP, SendGrid, Telegram
- 🧠 ML Anomaly Detection — Behavioral analysis & pattern recognition
- 📊 Compliance Reporting — SOC2, HIPAA, PCI-DSS, GDPR
- 🔍 Forensic Investigation — Attack timelines & evidence collection
- 🌐 Global Threat Intelligence — MITRE ATT&CK mapping & CVE correlation
|
5-second analysis cycles with sub-100ms alert generation. Advanced heuristic + ML-based threat correlation engine |
Native integrations: Email, SMTP, SendGrid, Telegram. Customizable alert routing and escalation policies |
Anomaly detection, behavioral analysis, and predictive threat scoring using proprietary algorithms |
Universal log processing pipeline: 7+ log sources → Smart router → 6 specialized detection pipelines → ML ensemble → MITRE tagger → Blockchain anchor → SOAR response → Unified dashboard
sequenceDiagram
participant Log as Log Event
participant Parser as Parser
participant DB as Database
participant HD as Heuristic Detection
participant ML as ML Anomaly
participant CVE as CVE Analyzer
participant ATK as Threat Recognizer
participant NIDS as NIDS Engine
participant Score as Scorer
participant Alert as Alert Manager
Log->>Parser: Raw text (any format)
Parser->>Parser: Auto-detect & parse
Parser->>DB: Normalize & store
par Parallel Detection
HD->>HD: Pattern matching
ML->>ML: Behavioral analysis
CVE->>CVE: CVE correlation
ATK->>ATK: MITRE ATT&CK map
NIDS->>NIDS: Traffic analysis
end
HD->>Score: Risk score 0-100
ML->>Score: Anomaly probability
CVE->>Score: Vuln severity
ATK->>Score: Threat actor ID
NIDS->>Score: Network risk
Score->>Score: Aggregate & weight
Score->>Alert: Final risk score
alt Risk > 85 CRITICAL
Alert->>Alert: CRITICAL
else Risk 60-85 HIGH
Alert->>Alert: HIGH
else Risk 40-60 MEDIUM
Alert->>Alert: MEDIUM
else Risk < 40 LOW
Alert->>Alert: LOW
end
flowchart TD
A["Threat Detected<br/>Risk Score Calculated"] --> B{Risk Level?}
B -->|CRITICAL 85-100| D["CRITICAL THREAT"]
B -->|HIGH 60-85| E["HIGH THREAT"]
B -->|MEDIUM 40-60| F["MEDIUM THREAT"]
B -->|LOW 0-40| G["INFO EVENT"]
D --> D1["SendGrid Email"]
D --> D2["Telegram Alert"]
D --> D3["Dashboard Notification"]
D --> D4["SOAR Auto-Response"]
D -->|Block IP/Revoke Token| D5["Containment"]
E --> E1["Email Alert"]
E --> E2["Dashboard Alert"]
F --> F1["Dashboard Only"]
G --> G1["Log Storage"]
D1 --> H["Live Dashboard<br/>Real-Time Updates"]
D2 --> H
D3 --> H
D4 --> H
E1 --> H
E2 --> H
F1 --> H
G1 --> I["Generate Reports"]
H --> I
I --> J["MITRE ATT&CK Timeline"]
J --> K["Blockchain Anchor"]
K --> L["Incident Closed"]
style D fill:#FF3838,stroke:#c0392b,color:#fff
style E fill:#FFD700,stroke:#ff8f00,color:#000
style F fill:#FFC700,stroke:#ff6f00,color:#000
style G fill:#00ff9d,stroke:#00cc7d,color:#000
style D5 fill:#FF0000,stroke:#990000,color:#fff
flowchart TD
A["Start"] --> B["Idle"]
B --> C["Timer: Every 5s"]
C --> D["Scanning: Ingest logs"]
D --> E["Parsing: Normalize & enrich"]
E --> F["Detection: Run engines"]
F --> G["Correlation: Analyze"]
G --> H["Analysis: ML scoring"]
H --> I["Scoring: Aggregate signals"]
I --> J{Risk Exceeded?}
J -->|No| K["Logging: Store SQLite"]
J -->|Yes| L["MITRE: Tag ATT&CK"]
K --> B
L --> M["BlockChain: Anchor"]
M --> N["Alert: Trigger pipeline"]
N --> O["Dispatch: Route channels"]
O --> P["Dashboard: WebSocket"]
P --> Q["Reporting: Generate"]
Q --> R["Archive: Long-term"]
R --> B
style A fill:#00ff9d,stroke:#00cc7d,color:#000
style J fill:#FFD700,stroke:#ff8f00,color:#000
style L fill:#FF3838,stroke:#c0392b,color:#fff
style P fill:#00D2FF,stroke:#0099cc,color:#000
style R fill:#9D00FF,stroke:#7a0080,color:#fff
graph TB
subgraph INPUT["Input Stage"]
I1["Syslog Server"]
I2["REST API/Webhook"]
I3["File Monitor"]
I4["Network Tap"]
end
subgraph PROCESS["Processing Stage"]
P1["Log Parser"]
P2["Data Normalizer"]
P3["Enrichment Engine"]
P4["Field Extractor"]
end
subgraph DETECT["Detection Stage"]
D1["Heuristics"]
D2["ML Anomalies"]
D3["CVE Database"]
D4["MITRE Mapping"]
D5["NIDS Rules"]
end
subgraph RESPOND["Response Stage"]
R1["Alert Manager"]
R2["Email Channel"]
R3["Telegram Channel"]
R4["Dashboard Stream"]
end
subgraph OUTPUT["Output Stage"]
O1["SQLite Database"]
O2["Live Dashboard"]
O3["PDF Reports"]
O4["SIEM Feed"]
end
I1 --> P1
I2 --> P1
I3 --> P1
I4 --> P1
P1 --> P2
P2 --> P3
P3 --> P4
P4 --> O1
P4 --> D1
P4 --> D2
P4 --> D3
P4 --> D4
P4 --> D5
D1 --> R1
D2 --> R1
D3 --> R1
D4 --> R1
D5 --> R1
R1 --> R2
R1 --> R3
R1 --> R4
O1 --> O2
O1 --> O3
O1 --> O4
R2 --> O2
R3 --> O2
R4 --> O2
style INPUT fill:#00D2FF,stroke:#0099cc,color:#000
style PROCESS fill:#FFD700,stroke:#ff8f00,color:#000
style DETECT fill:#FF3838,stroke:#c0392b,color:#fff
style RESPOND fill:#00ff9d,stroke:#00cc7d,color:#000
style OUTPUT fill:#9D00FF,stroke:#7a0080,color:#fff
| Component | Technology | Version |
|---|---|---|
| Runtime | Python | 3.9+ |
| Core | Rich | 13.0+ |
| Database | SQLite | 3.35+ |
| ML | NumPy | 1.24+ |
| Reporting | ReportLab | 4.0+ |
- Python 3.9+
- pip package manager
- Git
# 1. Clone repository
git clone https://github.com/Sharingan001/DeadCoderSociety.git
cd LogSentinel-Pro
# 2. Create virtual environment
python -m venv venv
source venv/bin/activate # Linux/macOS
# or
venv\Scripts\activate # Windows
# 3. Install dependencies
pip install -r requirements.txt
# 4. Configure environment
cp .env.example .env
# Edit .env with your API keys
# 5. Initialize database
python src/engines/config_manager.py --init-db# Set encoding on Windows to prevent Unicode errors
$env:PYTHONIOENCODING="utf-8"
# Run LogSentinel Main App
python src/cli/logsentinel_main.py
# Run LogSentinel Admin Console
python src/cli/logsentinel_admin.pyLogSentinel-Pro/
├── .env.example # Sample configuration
├── src/
│ ├── cli/ # Command-line interface
│ │ ├── logsentinel_main.py # Main CLI entry
│ │ └── logsentinel_admin.py # Admin panel
│ └── engines/ # Detection & processing
│ ├── advanced_detection.py # Heuristic detection
│ ├── anomaly_detection_ml.py # ML-based detection
│ ├── cve_analyzer.py # CVE correlation
│ ├── alert_manager.py # Alert routing
│ └── [+ 18 more engines]
├── requirements.txt # Dependencies
└── README.md # This file
✅ Innovation — ML anomaly detection + multi-channel alerting
✅ System Design — Scalable pipeline architecture
✅ Code Quality — Modular, well-documented codebase
✅ Completeness — All MVP features implemented
✅ UX — Interactive CLI interface
- ✅ Source code (complete & production-ready)
- ✅ README with setup instructions
- ✅ Modular engines architecture
- ✅ Documentation & Setup instructions
- Timeline: 24-hour MVP completion
- Focus: Core features first, advanced features second
- Bonus: Dashboard for real-time monitoring
- 🎯 Attack Simulation — Test detection rules safely
- 📄 PDF Reporting — Enterprise-grade compliance reports
- 🌐 Web Dashboard — Real-time monitoring & analytics
- 🤖 Telegram Alerts — Mobile notifications
- 📊 Analytics — Threat patterns & trends