Overview
SentinelOps is a cloud-native security operations platform that centralizes security event monitoring and incident management. It transforms incoming events into structured records, allowing analysts to review alerts, investigate suspicious activity, prioritize potential threats, and track incidents through a centralized dashboard.
The Problem
Security events come from different systems, each producing logs with different structures and levels of detail. Without a consistent way to process this information, identifying meaningful threats becomes difficult.
The challenge was designing a system that could standardize incoming security data, preserve important investigation details, and connect events to a structured incident response workflow.
Implementation
I designed a full-stack architecture connecting cloud-based event processing with an ASP.NET Core backend, PostgreSQL database, and React dashboard.
The platform processes incoming security events through validation and normalization before storing them in a consistent format. Events can then be associated with incidents, allowing analysts to investigate activity, manage priorities, and track incident status.
My Contribution
I designed the overall system architecture, security event schema, backend API structure, database model, and frontend experience.
I focused on separating event ingestion, validation, normalization, storage, and incident management into distinct responsibilities.
I also worked on authentication, API response consistency, logging, error handling, and the structure needed to support future cloud integrations.
Technical Decisions
One of my main architectural decisions was introducing a standardized security event model instead of allowing each data source to define its own structure throughout the application.
This makes it easier to process events from different sources without constantly changing the backend or dashboard.
I also separated raw event information from incident management data to preserve investigation context while allowing incidents to evolve independently.
Another important decision was using a relational database to maintain clear relationships between security events, alerts, and incidents.
Challenges
One of the main challenges was designing a flexible event schema that could represent different types of security activity without losing important details.
Another challenge was maintaining traceability between an incident and the original events that triggered it.
I also had to consider how the platform should handle invalid event data, processing failures, and inconsistent information without compromising the reliability of the incident management workflow.
What I Learned
Building SentinelOps taught me that security systems require a different approach to data integrity and error handling. I learned how important it is to preserve original event information while transforming data into a standardized format.
I also gained a better understanding of designing backend systems around clear responsibilities, particularly when separating event processing from incident management.
One of the most important lessons was that an alert is only useful if an analyst can understand where it came from, what triggered it, and how it relates to other security activity.
Current Status
SentinelOps is an evolving portfolio project focused on security operations architecture and full-stack development.
The current foundation covers structured security event processing, incident management, backend APIs, persistent storage, and an analyst-facing dashboard.
Future development will focus on expanding AWS integrations, introducing automated event enrichment, improving detection capabilities, and strengthening infrastructure automation.
What I'd Improve
I'd expand the event ingestion system to support additional AWS security services and introduce automated enrichment to provide more context around suspicious activity.
I'd also explore event correlation to identify relationships between alerts that might otherwise appear unrelated.
Other improvements would include real-time notifications, infrastructure as code, more detailed audit logging, and automated testing for security-sensitive workflows.