SentinelThread-Forensics

🛡️ Sentinel Thread Pro

The High-Speed Windows Forensic Triage Platform

📋 The Mission

In modern SOC operations, manual EVTX analysis is a death sentence for your MTTR (Mean Time to Respond). Sentinel Thread Pro is built to bridge the gap between massive raw event logs and actionable forensic intelligence. By orchestrating the Hayabusa engine (Rust-based) and a Pythonic data pipeline, this tool transforms thousands of noise-heavy events into a clean, prioritized threat timeline in seconds.

🚀 Key Engineering Features

• Blitz-Fast Triage: Processes massive .evtx files using the Hayabusa core for near-instant analysis.
• Sigma-Powered Detection: Native support for Sigma rules and Yamato Security's detection logic to hunt for adversary behavior.
• ATT&CK Mapping: Automatically maps detected events to MITRE ATT&CK® tactics and techniques.
• Intelligence-Driven UI: A reactive Streamlit dashboard built for analysts, allowing deep filtering by severity, hostname, or specific Rule IDs.
• Clean Data Normalization: A custom normalization layer that handles schema variations between different forensic engine versions.

🏗️ How it Works (The Architecture)

1. Ingestion: User uploads an artifact through the UI.
2. Execution: The Python backend triggers a non-interactive Hayabusa subprocess with strict --no-wizard and --json-timeline flags.
3. Refining: A Pandas-based processor cleans the raw JSON output, resolving field naming conflicts and calculating threat scores.
4. Visualization: The state-managed dashboard renders the data into an interactive forensic timeline.

🛠️ Setup & Deployment

1. Prerequisites

• Python 3.10 or higher.
• The Hayabusa Binary. Download it and place it in the bin/ directory.

2. Installation

# Clone the repository
git clone https://github.com/Adham504/SentinelThread-Forensics.git
cd SentinelThread-Forensics

# Set up the environment
python3 -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate

# Install the stack
pip install -r requirements.txt

3. Running the App

Always run from the src directory to ensure path integrity:

cd src
streamlit run app.py

📂 Project Structure

SentinelThread/
├── bin/              # Forensic Binaries (Exempt from Git)
├── logs/             # Where you store the .evtx file to process
├── output/           # Generated JSON/CSV results
├── rules/            # Hayabusa/Sigma detection logic
├── sigma_repo/       # Extended community rules
├── src/              # The Core Logic
│   ├── app.py              # Main Entry & UI State
│   ├── engine_handler.py   # Subprocess Orchestrator
│   └── data_processor.py   # Pandas Normalization Logic
└── requirements.txt