GraphSentinel AI

GraphSentinel investigates a security alert by traversing the relationships between identities, IPs, devices, services, vulnerabilities, indicators, evidence and past incidents stored in FalkorDB. An LLM agent (Azure OpenAI, Groq, or an offline deterministic planner) chooses which bounded, read-only graph tools to run. Deterministic engines then compute the risk score and decide which simulated response actions are eligible, and a human approves them.

On the demo dataset it finds a real 5-hop attack chain from the graph, links the alert to two earlier incidents through a shared indicator, collects supporting and contradicting evidence with provenance, and flags and ignores a prompt-injection attempt hidden in a helpdesk ticket. Every finding cites the graph records behind it, completed investigations are written back into the graph so related alerts can recall them, and every step lands in a hash-chained audit trail.

The backend is FastAPI and the frontend is React and TypeScript with React Flow, run together with Docker Compose. Access is role-based with four-eyes approval, so an investigator cannot approve their own investigation, plus CSRF protection and rate limiting. An evaluation suite runs 14 scenarios against a real FalkorDB (14 of 14 passing, 64 of 64 checks), and CI covers lint, type checks, tests, dependency audits, Trivy and gitleaks. All data is synthetic and all response actions are simulated. The hosted demo is a recorded replay of a real run, served as a static site; the full stack runs locally with Docker.