SentinelTrace

Keep-powered alert correlation meets Shuffle-backed response and Splunk-native AI investigation.

Comment

Inspiration

Security teams do not usually suffer from a lack of alerts — they suffer from too many disconnected alerts, too little context, and too much manual work before an incident becomes understandable. A single suspicious activity can appear as dozens of database, application, identity, and infrastructure alerts. By the time an analyst correlates them, investigates the evidence, maps the behavior to MITRE ATT&CK, checks compliance impact, and prepares an audit-ready report, valuable response time is already lost.

That inspired SentinelTrace: a Splunk-native, AI-assisted investigation platform that turns alert noise into one evidence-backed investigation case.

The core idea is simple:

Keep reduces alert noise and creates the case. Splunk provides the evidence. Gemma reasons over it. MITRE explains it. Compliance RAG scores it. Shuffle responds to it. SentinelTrace ties it together.

Instead of rebuilding an alert platform or SOAR platform from scratch, SentinelTrace takes an integration-first approach: adapt and extend strong existing systems, preserve what they already do well, and connect them into one investigation workflow.

What it does

SentinelTrace is a Keep-powered, Shuffle-backed, Splunk-native security and compliance investigation system.

It is designed around this workflow:

  1. Keep correlates many alerts into one investigation case
  2. Splunk MCP / Splunk SDK collects evidence
  3. Splunk Security Content and MITRE mappings explain the detection
  4. Gemma via OpenRouter performs case reasoning and RCA-style analysis
  5. Splunk Hosted Models support Splunk-native security/anomaly reasoning where available
  6. Compliance RAG maps evidence to GDPR / HIPAA / PCI / SOC 2-style risk
  7. Shuffle provides enrichment, SOAR workflows, and response actions
  8. SentinelTrace generates an audit-ready evidence report

A sample hero flow:

50 database access alerts are correlated into one suspicious bulk-data-access investigation case. SentinelTrace enriches the case with Splunk evidence, maps it to MITRE ATT&CK, uses Gemma to summarize likely root cause and rejected hypotheses, assesses GDPR-style compliance risk, recommends a Shuffle response workflow, and generates a final evidence report.

How we built it

The project was built as a clone, white-label, adapt, and integrate system rather than a from-scratch rebuild.

Core product base: Keep

Keep is used as the primary product foundation because it already provides the right shape for the main experience:

  • alert inbox
  • alert grouping
  • alert lifecycle
  • incident/case-style operations
  • workflow/provider concepts
  • AIOps-style dashboard

We adapted Keep into the SentinelTrace product shell by focusing the UI around:

  • Signal Inbox
  • Investigation Case
  • Splunk Evidence
  • RCA / AI Findings
  • MITRE Mapping
  • Compliance Risk
  • Shuffle Actions
  • Evidence Report

The goal was not to rebuild Keep’s existing strengths, but to preserve them and extend them into security/compliance investigation.

Automation layer: Shuffle

Shuffle is used as the SOAR and automation layer. Instead of duplicating Shuffle’s workflow engine inside Keep, SentinelTrace treats Shuffle as the action engine behind the case.

Shuffle handles:

  • threat-intel enrichment
  • response playbooks
  • containment workflows
  • notifications
  • external action execution

Inside SentinelTrace, a case can show recommended Shuffle actions such as:

  • enrich source IP
  • check threat intelligence
  • open a ticket
  • notify responders
  • execute or preview containment

Splunk evidence layer

Splunk is the evidence system. SentinelTrace connects to Splunk through:

  • Splunk MCP tools where available
  • Splunk SDK / REST fallback
  • Splunk Security Content for detections and analytic stories
  • MITRE mappings from Splunk security content sources

This lets the case view show actual investigation evidence instead of only AI-generated summaries.

AI reasoning layer

The AI layer uses:

  • Gemma via OpenRouter for general investigation reasoning, summaries, RCA-style analysis, compliance explanations, and report drafting
  • Splunk Hosted Models for Splunk-native security, anomaly, forecasting, or specialized analysis where available

Gemma is not treated as a standalone chatbot. Its output is attached directly to the investigation case and grounded in the evidence collected from Splunk.

Compliance layer

The compliance layer uses RAG and policy-pattern references to turn evidence into compliance-facing findings.

The system focuses first on GDPR-style suspicious data access, then can expand to HIPAA, PCI-DSS, and SOC 2.

A compliance finding includes:

  • framework
  • control or article
  • risk level
  • evidence references
  • short reasoning summary
  • recommended response
  • review status

Report layer

The final output is an evidence report that summarizes:

  • the original signal
  • correlated alerts
  • Splunk evidence
  • matched detection
  • MITRE mapping
  • RCA / rejected hypotheses
  • compliance risk
  • recommended Shuffle response action
  • final analyst/auditor summary

What we learned

1. Integration can be more powerful than rebuilding

The biggest lesson was that the fastest path to a complete system is not always writing every component from scratch. Keep already solves alert operations. Shuffle already solves automation. Splunk already stores the evidence. MITRE already provides the security vocabulary. The real value is in connecting them into a coherent workflow.

2. AI is strongest when grounded in evidence

An LLM can write a convincing incident summary, but that is not enough for security or compliance. The useful version is:

AI reasoning + Splunk evidence + detection mapping + policy context

That combination makes the output more trustworthy and easier to explain.

3. Alert correlation and response automation should stay separate

Keep and Shuffle overlap in some areas, but they are strongest when separated clearly:

  • Keep owns alert correlation and the case dashboard
  • Shuffle owns playbooks and response actions
  • SentinelTrace owns the integration, evidence, AI reasoning, compliance risk, and report

This separation keeps the product understandable.

4. Compliance needs traceability, not just summaries

For compliance use cases, the system cannot simply say “this is high risk.” It must show why:

  • what evidence was collected
  • which control is implicated
  • what action is recommended
  • what uncertainty remains

That shaped the report and case design.

Challenges we faced

Choosing the right product base

At first, there were many possible directions: build from an agent template, use an RCA platform, adapt a SOAR platform, or build a new UI. The clearer decision was to use Keep as the main dashboard because alert correlation and case management are central to the demo.

Avoiding duplicate features

Keep and Shuffle both have workflow-like concepts. The challenge was deciding what each should own. The final design keeps the overlap clean:

  • Keep handles alert/case lifecycle
  • Shuffle handles SOAR playbooks
  • SentinelTrace connects them

Keeping the UI unified

A simple toggle between Keep and Shuffle dashboards would preserve both systems, but it could feel like two products. The better approach is a Keep-first SentinelTrace dashboard with embedded Shuffle action panels, plus an optional automation-builder view when needed.

Making AI output credible

The AI layer needed to avoid unsupported claims. The plan was to attach Gemma’s reasoning to actual Splunk evidence, detection mappings, and policy context, so the final output is not just a generic LLM response.

Time and scope

The biggest challenge was scope control. The complete vision includes alert correlation, Splunk evidence, MITRE mapping, RCA, compliance scoring, Shuffle response, and reporting. The MVP focuses on one strong hero case instead of many shallow features.

What makes SentinelTrace different

SentinelTrace is not just another chatbot for security data. It is an integrated investigation workflow:

  • Keep turns alert noise into a case
  • Splunk provides evidence
  • Gemma explains and reasons over the case
  • MITRE maps behavior to security techniques
  • Compliance RAG turns evidence into audit-facing risk
  • Shuffle executes or previews response workflows
  • SentinelTrace presents the full story in one productized experience

What's next

Future improvements include:

  • deeper live Splunk integration
  • more Shuffle playbooks
  • more compliance frameworks
  • richer MITRE coverage views
  • case collaboration features
  • stronger report export
  • automated evidence bundles
  • Splunk KV Store-backed case state
  • more Splunk Hosted Model usage for anomaly detection and forecasting

Summary

SentinelTrace transforms alert operations into audit-ready investigation.

It combines Keep, Shuffle, Splunk, Gemma, MITRE, and compliance RAG into one workflow that helps teams move from:

“We have 50 alerts”

to:

“We have one evidence-backed investigation case, mapped to security techniques, assessed for compliance risk, and ready for response.”

Built With

  • fastapi
  • models
Share this project:

Updates