Commercial detection tools cost six figures a year or ship your traffic abroad. Sentinel watches client networks from a small on-site tap and only spends heavy compute on what actually looks wrong.
How it works
- Pi tap · WireGuard
- Zeek + syslog
- Redis
- Isolation Forest
- XGBoost
- Autoencoder
- PostgreSQL
- Dashboard + local analyst
Only events the Isolation Forest flags go on to XGBoost and the autoencoder. Normal events go straight to PostgreSQL.
What I did
- Chose the stack and drove the technical decisions
- Built the cascade and per-client workers on Redis
- Set up biweekly retraining with live model hot-swap
- Designed the database: one PostgreSQL schema per client
- Built the client dashboard
- Role
- Lead developer (chose the stack, built most of the platform)
- Team
- Team of 2
- Stack
- Python, Redis, PostgreSQL, scikit-learn, XGBoost, TensorFlow/Keras, Zeek, Filebeat, FastAPI, Docker, WireGuard, Raspberry Pi, Ollama
- Status
- In use at Interface Numérique
- Proprietary: write-up only

















BlaBlaCase






