Upload 114 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+src/database/sentinel.duckdb filter=lfs diff=lfs merge=lfs -text

artifacts/device_profiles.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b1f8b6c6fc7800adba01f8340128ff39998d85219c34ed028b5195c98c527111
+size 91217

artifacts/user_profiles.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3540a45415149d7e8756683c37d6c8eaabd72f16fa7160e1b4c16206a4d29d55
+size 116295

config/development/config.yaml

@@ -0,0 +1,40 @@
+app:
+  name: "SentinelAI"
+  environment: "development"
+  version: "1.0.0"
+
+paths:
+  raw_data: "data/raw"
+  processed_data: "data/processed"
+  artifacts: "artifacts"
+  predictions: "predictions"
+  reports: "reports"
+  database: "database/sentinel.duckdb"
+
+duckdb:
+  memory_limit: "4GB"
+  threads: 4
+
+risk_weights:
+  rule_contribution: 0.30
+  stat_contribution: 0.10
+  ml_contribution: 0.40
+  behavioral_contribution: 0.10
+  device_contribution: 0.10
+
+classification_labels:
+  - "Normal Authentication"
+  - "Credential Stuffing"
+  - "Password Spray"
+  - "Brute Force"
+  - "Impossible Travel"
+  - "Insider Threat"
+  - "Privilege Abuse"
+  - "Suspicious Device"
+
+recommendations:
+  Low: "Monitor"
+  Moderate: "Review activity"
+  Elevated: "Step-up Authentication"
+  High: "Require MFA, Notify SOC"
+  Critical: "Lock account, Block authentication, Escalate incident"

models/classifier_metadata_20260725_150213.json

@@ -0,0 +1 @@
+{"model_version": "20260725_150213", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T15:02:13.103538", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "labels": ["Normal Authentication", "Credential Stuffing", "Password Spray", "Brute Force", "Impossible Travel", "Insider Threat", "Privilege Abuse", "Suspicious Device"], "hyperparameters": {"objective": "multi:softprob", "base_score": null, "booster": null, "callbacks": null, "colsample_bylevel": null, "colsample_bynode": null, "colsample_bytree": null, "device": null, "early_stopping_rounds": null, "enable_categorical": true, "eval_metric": "mlogloss", "feature_types": null, "feature_weights": null, "gamma": null, "grow_policy": null, "importance_type": null, "interaction_constraints": null, "learning_rate": null, "max_bin": null, "max_cat_threshold": null, "max_cat_to_onehot": null, "max_delta_step": null, "max_depth": null, "max_leaves": null, "min_child_weight": null, "missing": NaN, "monotone_constraints": null, "multi_strategy": null, "n_estimators": null, "n_jobs": null, "num_parallel_tree": null, "random_state": 42, "reg_alpha": null, "reg_lambda": null, "sampling_method": null, "scale_pos_weight": null, "subsample": null, "tree_method": null, "validate_parameters": null, "verbosity": null, "num_class": 8}, "performance_metrics": {"mlogloss": "computed_during_eval"}, "model_checksum": "32a9d42885fd12098224c4a4796760342bdc80553723c31800456822c5d8619a", "model_file": "xgboost_attack_classifier_20260725_150213.json"}

models/isolation_forest/model_metadata.json

@@ -0,0 +1 @@
+{"version": "1.0", "training_timestamp": "2026-07-25T04:47:49.069387", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"]}

models/isolation_forest/model_metadata_20260725_082113.json

@@ -0,0 +1 @@
+{"model_version": "20260725_082113", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:21:13.285371", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "86ccfd7ed996e36e95505a993c78c23c940abd059f29c2316c5fd2e2b0e3e5b4", "model_file": "trained_isolation_forest_20260725_082113.pkl"}

models/isolation_forest/model_metadata_20260725_083613.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083613", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:36:13.965758", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e", "model_file": "trained_isolation_forest_20260725_083613.pkl"}

models/isolation_forest/model_metadata_20260725_083627.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083627", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:36:28.043916", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164", "model_file": "trained_isolation_forest_20260725_083627.pkl"}

models/isolation_forest/model_metadata_20260725_083645.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083645", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:36:45.282230", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e", "model_file": "trained_isolation_forest_20260725_083645.pkl"}

models/isolation_forest/model_metadata_20260725_083659.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083659", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:36:59.599062", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164", "model_file": "trained_isolation_forest_20260725_083659.pkl"}

models/isolation_forest/model_metadata_20260725_083718.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083718", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:37:18.661853", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e", "model_file": "trained_isolation_forest_20260725_083718.pkl"}

models/isolation_forest/model_metadata_20260725_083733.json

@@ -0,0 +1 @@
+{"model_version": "20260725_083733", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T08:37:33.135731", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164", "model_file": "trained_isolation_forest_20260725_083733.pkl"}

models/isolation_forest/model_metadata_20260725_134120.json

@@ -0,0 +1 @@
+{"model_version": "20260725_134120", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:41:20.916692", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "17f84b1bbba77b456c7499e1fab8db46cc3ba7b9693feb1c5378efd1ad805f3c", "model_file": "trained_isolation_forest_20260725_134120.pkl"}

models/isolation_forest/model_metadata_20260725_134134.json

@@ -0,0 +1 @@
+{"model_version": "20260725_134134", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:41:35.024531", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "fdfb59ea8e91aa40efd8961aee375ec1cec2e70a0ffb3ec164d07309aef0647f", "model_file": "trained_isolation_forest_20260725_134134.pkl"}

models/isolation_forest/model_metadata_20260725_134455.json

@@ -0,0 +1 @@
+{"model_version": "20260725_134455", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:44:55.095284", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "b88ce9c7a7043869f0f379fa4421c482ac1cb9f98cd6037ee19109cffbd185f2", "model_file": "trained_isolation_forest_20260725_134455.pkl"}

models/isolation_forest/model_metadata_20260725_134513.json

@@ -0,0 +1 @@
+{"model_version": "20260725_134513", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:45:13.233663", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "e3c39b3b0c92a9c2e0119a5d71a5b02525261f49e1a9adc935ba141ac51ebf8d", "model_file": "trained_isolation_forest_20260725_134513.pkl"}

models/isolation_forest/model_metadata_20260725_135630.json

@@ -0,0 +1 @@
+{"model_version": "20260725_135630", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:56:31.003748", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "1112310517225fa3fec32061c83e11492b4358d151c908bc33ee121ab480aab5", "model_file": "trained_isolation_forest_20260725_135630.pkl"}

models/isolation_forest/model_metadata_20260725_135644.json

@@ -0,0 +1 @@
+{"model_version": "20260725_135644", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:56:45.027991", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "0c2e17151a30d4f593d3d843c30fbdfa259c6fa0fdf7de4022c369828f68b8f5", "model_file": "trained_isolation_forest_20260725_135644.pkl"}

models/isolation_forest/model_metadata_20260725_135941.json

@@ -0,0 +1 @@
+{"model_version": "20260725_135941", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:59:41.278734", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "1112310517225fa3fec32061c83e11492b4358d151c908bc33ee121ab480aab5", "model_file": "trained_isolation_forest_20260725_135941.pkl"}

models/isolation_forest/model_metadata_20260725_135956.json

@@ -0,0 +1 @@
+{"model_version": "20260725_135956", "training_dataset_version": "1.0", "feature_schema_version": "1.0", "training_date": "2026-07-25T13:59:56.112081", "feature_schema": ["hour_of_day", "day_of_week", "is_weekend", "is_working_hour", "is_failure", "country_encoded", "is_mfa", "time_since_last_login", "rolling_failures_24h"], "hyperparameters": {"n_estimators": 100, "contamination": 0.05}, "performance_metrics": {"estimated_anomaly_rate": 0.05}, "model_checksum": "ab81106a73c5ad4dd516cbcb245059f52037dca4602eb8592da7e0f7af2e2fd7", "model_file": "trained_isolation_forest_20260725_135956.pkl"}

models/isolation_forest/trained_isolation_forest.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:408d319941b9827f6ff30914cadaaa171c792ca6b4a3fb057456d84d9e8388c9
+size 477202

models/isolation_forest/trained_isolation_forest_20260725_082113.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86ccfd7ed996e36e95505a993c78c23c940abd059f29c2316c5fd2e2b0e3e5b4
+size 1584267

models/isolation_forest/trained_isolation_forest_20260725_083613.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e
+size 274195

models/isolation_forest/trained_isolation_forest_20260725_083627.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164
+size 491819

models/isolation_forest/trained_isolation_forest_20260725_083645.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e
+size 274195

models/isolation_forest/trained_isolation_forest_20260725_083659.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164
+size 491819

models/isolation_forest/trained_isolation_forest_20260725_083718.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a2b0f665f57d953e04608234921b5102179d3816b633c1dad9ef7974bafd869e
+size 274195

models/isolation_forest/trained_isolation_forest_20260725_083733.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c341a653016cbef911b0fa4f0d6e79cf426b3200c4ca32cdb2b263e7afa74164
+size 491819

models/isolation_forest/trained_isolation_forest_20260725_134120.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:17f84b1bbba77b456c7499e1fab8db46cc3ba7b9693feb1c5378efd1ad805f3c
+size 274741

models/isolation_forest/trained_isolation_forest_20260725_134134.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fdfb59ea8e91aa40efd8961aee375ec1cec2e70a0ffb3ec164d07309aef0647f
+size 470884

models/isolation_forest/trained_isolation_forest_20260725_134455.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b88ce9c7a7043869f0f379fa4421c482ac1cb9f98cd6037ee19109cffbd185f2
+size 259542

models/isolation_forest/trained_isolation_forest_20260725_134513.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e3c39b3b0c92a9c2e0119a5d71a5b02525261f49e1a9adc935ba141ac51ebf8d
+size 533743

models/isolation_forest/trained_isolation_forest_20260725_135630.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1112310517225fa3fec32061c83e11492b4358d151c908bc33ee121ab480aab5
+size 257597

models/isolation_forest/trained_isolation_forest_20260725_135644.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0c2e17151a30d4f593d3d843c30fbdfa259c6fa0fdf7de4022c369828f68b8f5
+size 537958

models/isolation_forest/trained_isolation_forest_20260725_135941.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1112310517225fa3fec32061c83e11492b4358d151c908bc33ee121ab480aab5
+size 257597

models/isolation_forest/trained_isolation_forest_20260725_135956.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ab81106a73c5ad4dd516cbcb245059f52037dca4602eb8592da7e0f7af2e2fd7
+size 537254

src/__init__.py

@@ -0,0 +1 @@
+# Init