Overview
- open suspicious URLs in a controlled environment
- capture screenshots and rendered HTML
- extract indicators of compromise (IOCs)
- identify phishing signals
- document findings in a structured report
SentinelOps Platform Overview
SentinelOps models a real SOC-style phishing investigation workflow, transforming a suspicious URL into structured, analyst-ready outputs.
System Architecture
The platform follows a modular pipeline:
- Analyst submits a suspicious URL
- Browser automation collects rendered webpage artifacts
- Indicators of compromise are extracted
- Phishing detection features are derived
- A deterministic risk score is calculated
- LLM generates structured analysis
- Reports are created and stored
- Case data is persisted in SQLite
CLI Investigation Workflow
SentinelOps is operated through a command-line interface:
python -m app.main --url "https://example.com" --notes "Investigation test"
During execution, the system:
- launches a browser session
- captures HTML and screenshots
- extracts IOCs
- derives phishing indicators
- calculates a risk score
- generates structured reports
Browser Evidence Collection
Using Playwright, SentinelOps captures:
- Full-page screenshot
- Rendered HTML snapshot
- Visible text
- Forms and input fields
- Buttons and links
- Page metadata
IOC Extraction & Detection
- URLs
- Domains
- Email addresses
- IP addresses
- Suspicious keywords
- Brand mentions
- login form presence
- credential prompts
- urgency language
- payment-related language
- impersonation indicators
- suspicious domain patterns
Risk Scoring Engine
- Low
- Medium
- High
- Critical
LLM-Assisted Threat Analysis
- Classification
- Threat summary
- Analyst rationale
- Confidence level
- Recommended actions
Investigation Outputs
Markdown Analyst Report
Provides a human-readable investigation summary including:
- case details
- detected indicators
- phishing features
- severity classification
- recommended actions
JSON Structured Report
Machine-readable output containing:
- extracted indicators
- detection features
- risk score
- LLM analysis
- investigation metadata
HTML Snapshot Artifact
Stores the full rendered HTML for:
- offline analysis
- evidence preservation
- forensic review
Case Persistence (SQLite)
Each investigation is stored in a SQLite database, including:
- case ID
- URL
- classification
- severity
- report paths
- artifact locations
Testing & Validation
SentinelOps includes automated testing using pytest to validate:
- IOC extraction
- phishing feature detection
- risk scoring logic
- report generation
CLI Interface
The CLI provides a simple interface for running investigations with options for:
- URL input
- analyst notes
- investigation mode
Technologies Used
- Phishing analysis
- IOC extraction
- Threat detection logic
- Risk scoring
- Python
- Playwright
- BeautifulSoup
- Typer CLI
- Pydantic
- OpenRouter
- SQLite
- pytest
Outcome
- Built a full phishing investigation pipeline from scratch
- Automated browser-based evidence collection
- Developed deterministic detection and scoring logic
- Integrated LLM-assisted structured analysis
- Generated analyst-ready and machine-readable reports
- Implemented persistent case tracking with SQLite
- Validated core functionality with automated testing
Project Link
https://github.com/HaythamAbouelfaid/SentinelOps
