CyberSentinel: Building a Threat Detection Pipeline

CyberSentinel is a multi-stage security analysis pipeline. It ingests raw logs from firewalls, SSH, web servers, and intrusion detection systems, identifies threats, maps them to MITRE ATT&CK and the Cyber Kill Chain, and generates a report with severity scores and indicators of compromise. For the live demo, I’ll run it against a simulated 5-phase attack (port scanning, SSH brute force, background noise, SQL injection, data exfiltration) and show how 458 log lines become 2 correlated threat clusters and 12 IOCs in under 2 seconds.