Sentinel-EDR

Sentinel-EDR is a lightweight, open-source agent–server Endpoint Detection and Response (EDR) tool.
It allows security teams to deploy agents on endpoints, collect suspicious activity logs, and forward them to a central server.
The server provides a real-time dashboard with severity-based color-coded alerts for quick and effective threat monitoring.

---

🚀 Features

• 🖥️ Agent–Server Architecture
  Deploy agents across multiple endpoints and centralize logs in one dashboard.

• 🔍 Suspicious Activity Detection
  Detects common endpoint threats such as:

  • Execution of scripts from untrusted folders (PowerShell, CMD, VBS).
  • Modification or deletion of critical system files by non-admin accounts.
  • Suspicious outbound network connections from apps like Microsoft Office or Adobe Reader.
  • Creation of scheduled tasks or services by non-system processes.

• 🎨 Dashboard with Dark Mode
  A modern web-based dashboard with dark mode UI and color-coded alerts (Critical, High, Medium, Low).

• 🔑 API Key Authentication
  Agents authenticate with the server using a secure API key.

• ⚡ Lightweight & Easy to Deploy
  Written in pure Python (Flask + requests), no heavy dependencies.

  🔧 Customization – Adding Your Own Detection Rules

  One of the strengths of Sentinel-EDR is flexibility.
  You can easily extend or modify the suspicious activity detection rules in the agent script.

  📌 Where are the rules defined?

• Rules are stored inside the rules dictionary in agent.py.
• Each rule has three key parts:
  • description → human-readable explanation of the suspicious activity.
  • severity → Low, Medium, High, or Critical.
  • condition → Python logic that checks process names, file paths, or network activity.