SentinelCore

SentinelCore is a local Windows security telemetry prototype.

It collects Windows Security, System, Sysmon, and PowerShell events, applies a rules engine, uses an Intel NPU through OpenVINO for lightweight scoring, and calls an Ollama GPU model only when the score crosses a threshold.

Windows logs and Sysmon
        |
        v
JSON event export
        |
        v
Rules engine
        |
        v
NPU Sentinel scoring
        |
        +-- normal or interesting -> save report and stay light
        |
        +-- suspicious or critical -> Ollama GPU Investigator
                                      |
                                      v
                              Markdown report

Status

SentinelCore is a public prototype / alpha.

It is not production EDR software yet. It is useful as a local security-monitoring experiment, a learning project, and a foundation for future Windows endpoint detection work.

See docs/production-readiness.md before using or sharing it.

What It Does

• Enables Windows audit policy needed for endpoint telemetry.
• Enables PowerShell script block logging.
• Installs Sysmon with a starter Sysmon configuration.
• Collects selected events into data/events-*.json.
• Deduplicates already analyzed events.
• Polls for emergency events every 30 seconds.
• Runs normal analysis every 5 minutes in Balanced mode.
• Uses OpenVINO NPU inference for lightweight normal / interesting / suspicious / critical scoring.
• Uses Ollama only when the NPU score crosses the GPU threshold.
• Writes Markdown security reports under reports/.

What It Does Not Do Yet

• It does not provide tamper protection.
• It does not replace Microsoft Defender, an EDR, or a SIEM.
• It does not ship with a trained threat model.
• It does not redact reports automatically.
• It does not include signed releases or an installer.
• It does not have CI or a full automated test suite yet.

Requirements

• Windows 11 or Windows Server with PowerShell.
• Administrator PowerShell for audit policy, Sysmon install, and scheduled task registration.
• Python with venv support.
• Ollama for the optional GPU Investigator.
• Intel NPU and OpenVINO for NPU acceleration.
• Sysmon, installed by the setup script.

The project was built around a local C:\SentinelCore checkout, but scripts derive the root from their own location and also support SENTINELCORE_ROOT.

Quick Start

Clone or place the project at:

C:\SentinelCore

Create the Python environment:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\setup-python.ps1

Open PowerShell as Administrator and enable logging:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\enable-windows-logging.ps1

Install Sysmon:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\install-sysmon.ps1

Optional: install or pull an Ollama model:

ollama pull qwen2.5:14b

If that model is not installed, SentinelCore will use the first installed Ollama model it finds.

Manual Run

Collect a 10-minute overlap and analyze new events:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\run-sentinelcore.ps1

Force a different collection window or GPU threshold:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\run-sentinelcore.ps1 -Minutes 10 -GpuThreshold 70

Resident Monitor

Balanced mode is the recommended starting point:

Poll logs every 30 seconds.
Analyze once every 5 minutes.
Collect the last 10 minutes for overlap.
Run GPU investigation only when NPU score is 70 or higher.
Run immediately if a super-critical event appears.

Run manually:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\sentinelcore-monitor.ps1

Register the monitor at logon:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\register-sentinelcore-scheduled-task.ps1 -Mode Balanced -StartNow

Remove scheduled tasks:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\unregister-sentinelcore-scheduled-task.ps1

Modes

Mode	Polling	Full analysis	Collection window	GPU threshold
BatterySaver	60 seconds	15 minutes	30 minutes	90
Balanced	30 seconds	5 minutes	10 minutes	70
HighAlert	30 seconds	1 minute	5 minutes	70

NPU Checks

Probe OpenVINO devices:

C:\SentinelCore\.venv\Scripts\python.exe C:\SentinelCore\npu\npu_probe.py

Run a visible NPU activity test:

C:\SentinelCore\.venv\Scripts\python.exe C:\SentinelCore\npu\npu_activity_test.py --seconds 30

Tests

Run the current Python unit tests:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\run-tests.ps1

Output

Generated output is intentionally ignored by Git:

• data/events-*.json
• reports/sentinelcore-report-*.md
• state/
• npu/npu-status.json
• Sysmon/
• Sysmon.zip
• .venv/

Do not publish generated telemetry or reports without reviewing them. They can contain usernames, hostnames, command lines, file paths, DNS names, IP addresses, and script contents.

Run the publish-safety check before pushing:

powershell -ExecutionPolicy Bypass -File C:\SentinelCore\scripts\check-publish-safety.ps1

Configuration

Environment variables:

Variable	Default	Purpose
SENTINELCORE_ROOT	script parent	Project root override
SENTINELCORE_OLLAMA_URL	http://127.0.0.1:11434	Ollama API URL
SENTINELCORE_OLLAMA_MODEL	qwen2.5:14b	Preferred GPU investigator model
SENTINELCORE_GPU_THRESHOLD	70	NPU score required before GPU report
SENTINELCORE_NPU_ITERATIONS	25	Number of NPU inference iterations per analysis
SENTINELCORE_MAX_FINDINGS_FOR_AI	60	Max findings sent to Ollama
SENTINELCORE_MAX_INFO_FINDINGS	100	Max informational findings kept per report

Safety Notes

This project changes Windows auditing settings and installs Sysmon. Review scripts before running them. Run setup scripts only on systems you own or administer.

The detection rules are heuristic. Treat findings as investigation leads, not proof of compromise.

Roadmap

• Add unit tests and CI.
• Add configurable rules.
• Add report redaction.
• Add JSON findings output.
• Add Windows service packaging.
• Add a real trained NPU classifier.
• Add dashboard support.

License

SentinelCore is licensed under the Apache License, Version 2.0. See LICENSE.