Summary

CyberSentinel AI is a local, agentic cybersecurity platform executing a suite of 33 real tools via Docker. It targets security professionals and researchers seeking a comprehensive, locally-run arsenal that leverages AI for analysis and decision-making, offering an alternative to cloud-based or command-line-only solutions. The primary benefit is a powerful, integrated, and locally-controlled cybersecurity workflow.

How It Works

The platform uses agentic execution: AI classifies intent, selects tools, and orchestrates their execution within an isolated Kali Linux sandbox container. Results are analyzed in real-time, with AI responses grounded by a RAG engine (ChromaDB) using security knowledge bases (MITRE, NIST). A Neo4j graph maps attack surfaces and threat relationships, while an ELK Stack provides SIEM capabilities. This ensures live, verifiable tool execution and provider-agnostic AI integration.

Quick Start & Requirements

• Prerequisites: Docker Desktop installed and running, 8GB+ RAM recommended.
• Installation: Clone the repository, copy .env.example to .env, and run docker compose up -d --build. Initial setup may take 5-10 minutes to pull images.
• AI Model: A local AI model (e.g., qwen2.5:7b) can be pulled via docker exec -it cybersentinel-v2-ollama-1 ollama pull qwen2.5:7b (approx. 4GB, one-time).
• Access: The dashboard is available at http://localhost:3000.
• Docs: https://github.com/3sk1nt4n/cybersentinel-ai

Highlighted Details

• Comprehensive Arsenal: Integrates 33 security tools across scanning, threat intelligence, SIEM, AI detection, threat hunting, and compliance categories.
• Local & Offline First: Designed to run 100% locally via Docker, with optional cloud AI provider integration.
• Agentic AI Execution: AI dynamically selects and runs tools, analyzes results, and provides context-aware responses.
• RAG-Grounded AI: Utilizes ChromaDB for Retrieval Augmented Generation, enhancing AI responses with curated security knowledge.
• Knowledge Graph: Employs Neo4j to map attack surfaces, MITRE techniques, and threat relationships.
• Provider Agnostic AI: Seamlessly switch between Ollama, Claude, GPT, and OpenRouter AI models during a conversation.

Maintenance & Community

The project is maintained by 3sk1nt4n and powered by SolventCyber.com. No specific community links (Discord, Slack) or detailed contributor information beyond the primary author are provided in the README.

Licensing & Compatibility

The project is released under the MIT License, permitting broad use, modification, and distribution, including for commercial purposes, with minimal restrictions.

Limitations & Caveats

Initial Docker image pulls can take 5-10 minutes. Advanced cloud AI models or specific threat intel feeds require obtaining and configuring corresponding API keys. 8GB+ RAM is recommended for smooth operation.