docs/DEMO_SCRIPT.md

# SentinelAI — Judge Demo Script (do not improvise)

## Preconditions (2 minutes before)

1. Terminal A — API:  
   `cd SentinelAI && source .venv/bin/activate && export PYTHONPATH=$PWD && export SKIP_DB=1`  
   `uvicorn backend.app.main:app --host 0.0.0.0 --port 8000`
2. Terminal B — UI:  
   `cd SentinelAI/frontend && NEXT_PUBLIC_API_URL=http://127.0.0.1:8000 npm run dev`
3. Open dashboard at `http://localhost:3000` (or your dev URL).

## The flow (≈3–4 minutes)

1. **Start continuous simulation**  
   Terminal C: `python scripts/continuous_demo.py`  
   Say: *“This is autonomous traffic — no manual log upload.”*

2. **Live stream**  
   Point at **Live Threat Feed** and **terminal strip**.  
   Say: *“Collector → parser → enrichment → detection — everything is event-driven.”*

3. **Threat detected**  
   When **detection** rows appear with severity, say: *“Rules + sliding windows — brute-force and post-auth patterns.”*

4. **Incident chain**  
   Point at **Attack Timeline** when an incident appears.  
   Say: *“Correlation fuses events by source into one narrative.”*

5. **AI investigation**  
   Wait for **AI Investigation** to populate (auto-runs after an incident; may take up to ~`AUTO_AI_MIN_SEC` between runs).  
   Say: *“Analyst layer — progression, severity rationale, remediation bullets — local Llama/Qwen on AMD ROCm when configured.”*

6. **WOW — Replay**  
   Click **Replay last chain**.  
   Say: *“We’re re-streaming the buffered kill chain for the jury — same detections and AI report, cinematic replay.”*

7. **Remediation**  
   Scroll AI panel for **Recommended actions** (or call `POST /remediation` with `incident_id` if you show API).  
   Say: *“Playbooks block IOCs, rotate creds, harden IAM.”*

8. **AMD story**  
   Point at **Powered by AMD ROCm** panel (GPU %, latency, concurrent agents are demo-swayed metrics).  
   Say: *“Open weights, on-prem, parallel agents — ROCm is our inference path for SOC-scale throughput.”*

## Optional soak test (10–15 minutes)

- Leave `continuous_demo.py` running; confirm API stays up, WebSocket shows heartbeats, UI stays responsive.
- If the LLM is down, narratives still read well — **cinematic fallback** is always on.

## Backup

- If live demo fails: use your **screen recording** (see `docs/RECORDING_CHECKLIST.md`).