A web-based tool that leverages Large Language Models (LLMs) to provide rapid, intelligent analysis of phishing emails for SOC analysts.
Sentinel accelerates SOC analysts' decision-making process during phishing email analysis by providing AI-generated interpretive analysis of reported phishing emails. The tool reduces analysis time from 10 minutes to under 1 minute per email, enabling analysts to handle 5x more alerts while reducing cognitive load and burnout.
- Instant Email Analysis: Paste raw email content and receive AI-powered analysis within 30 seconds
- Intent Classification: Identify phishing intent (credential theft, wire transfer fraud, malware delivery, etc.)
- Deception Indicators: Highlight social engineering tactics and suspicious elements
- Risk Scoring: Contextual risk assessment with confidence levels
- IOC Extraction: Automatic extraction of URLs, IPs, and domains with VirusTotal integration
- Clean Interface: Intuitive web interface designed for SOC analysts
- React 18+ with TypeScript
- Tailwind CSS for styling
- Vite for build tooling
- Vitest for testing
- React Query for state management
- FastAPI (Python) for high-performance async API
- Pydantic for data validation
- OpenAI/Anthropic/Google LLM integration
- VirusTotal API integration
- Node.js 18+
- Python 3.9+
- API keys for LLM providers (OpenAI, Anthropic, or Google)
-
Clone the repository
git clone <repository-url> cd sentinel
-
Set up the backend
cd backend python -m venv venv source venv/bin/activate # On Windows: venv\Scripts\activate pip install -r requirements.txt cp .env.example .env # Edit .env with your API keys
-
Set up the frontend
cd frontend npm install cp .env.example .env.local # Edit .env.local if needed
-
Start the backend
cd backend source venv/bin/activate uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
-
Start the frontend
cd frontend npm run dev -
Access the application
- Frontend: http://localhost:3000
- Backend API: http://localhost:8000
- API Documentation: http://localhost:8000/docs
# LLM Provider Configuration
OPENAI_API_KEY=your_openai_api_key_here
PRIMARY_LLM_PROVIDER=openai
FALLBACK_LLM_PROVIDER=anthropic
# VirusTotal Configuration
VIRUSTOTAL_API_KEY=your_virustotal_api_key_here
# API Configuration
API_HOST=0.0.0.0
API_PORT=8000
CORS_ORIGINS=["http://localhost:3000"]VITE_API_BASE_URL=http://localhost:8000- Paste Email Content: Copy and paste the raw email content (including headers) into the text area
- Analyze: Click the "Analyze" button to process the email
- Review Results: View the AI-generated analysis including:
- Primary intent and confidence level
- Deception indicators with evidence
- Risk score and reasoning
- Extracted IOCs with VirusTotal links
See DEVELOPMENT.md for detailed development guidelines, coding standards, and contribution instructions.
Frontend:
cd frontend
npm run testBackend:
cd backend
pytestFrontend:
npm run lint
npm run formatBackend:
black app/
isort app/
flake8 app/
mypy app/The backend API provides the following endpoints:
POST /api/analyze- Analyze phishing email contentGET /api/health- Health check endpoint
Full API documentation is available at http://localhost:8000/docs when running the backend.
- Input Sanitization: XSS prevention and malicious content removal
- Memory Management: Automatic cleanup of sensitive email content
- Request Validation: Size limits and content validation
- Security Headers: Comprehensive security headers on all responses
- Threat Detection: Real-time detection of malicious patterns
- Secure Logging: Sensitive data filtering in all logs
- Concurrent Processing: Handles up to 50 concurrent requests
- Performance Monitoring: Real-time system and request metrics
- Rate Limiting: 60 requests per minute per IP with burst protection
- Memory Optimization: Automatic memory cleanup and garbage collection
- Resource Monitoring: CPU and memory usage tracking with alerts
For detailed information, see SECURITY_PERFORMANCE.md
- Analysis completes within 30 seconds for typical emails
- Supports concurrent analysis requests
- Optimized LLM prompts for speed and accuracy
- Caching for improved response times
- Fork the repository
- Create a feature branch
- Follow the development guidelines in DEVELOPMENT.md
- Submit a pull request
[License information to be added]
For issues and questions:
- Check the troubleshooting section in DEVELOPMENT.md
- Search existing issues
- Create a new issue with detailed information
- Additional LLM provider integrations
- Enhanced IOC analysis
- Batch email processing
- Advanced reporting features
- Integration with SIEM platforms