security · July 2026
SentinelForge
A security-first workspace that turns a folder of detection rules into a searchable, versioned, auditable Sigma library. Analysts import Sigma YAML, validate it with pySigma, read an explainable quality score, map rules to MITRE ATT&CK, review diffs across immutable versions, and export again — all through a typed REST API. Strictly defensive: it has no collectors, agents, or remote execution.
Tornike Kalandadze — software engineer & technical lead, client delivery since 2019 · Tbilisi (GMT+4)
Problem
Detection rules tend to rot in a folder: no history, no consistent quality bar, no map to what they actually cover. Reviewing a change means eyeballing raw YAML, and importing someone else's rule pack means trusting an archive you did not write — a classic path for ZIP traversal and decompression bombs.
Approach
Treat rules as a first-class, versioned asset behind a typed API. Sigma is parsed safely (bounded YAML with size and nesting limits, pySigma validators, no shell or subprocess anywhere in the path) and scored by an explainable rubric so quality has reasons, not vibes. Every edit becomes an immutable version with a diff and non-destructive restore; imports are vetted for traversal, symlinks, entry counts, expanded size, and compression ratio and handled in memory only. Access is default-deny with analyst/admin RBAC, and the service refuses to boot in production while the shipped example key is still in place.
Impact
A working rule library with the parts that matter already built: safe import, explainable scoring, immutable version history with diffs, ATT&CK mapping over a bundled Enterprise v19.1 snapshot, and real auth with audit logging — all runnable against SQLite with zero external services. It is honest about scope (an engineering project, not a production SIEM); ingestion, a live Sigma evaluator, and the web UI are the tracked roadmap.
Through every lens
01 · Full-stack
A synchronous-by-design FastAPI service: rule parsing and bounded evaluation are CPU-bound, so endpoints run in the thread pool instead of pretending to be async. SQLAlchemy models use native UUID/JSONB on PostgreSQL and portable types on SQLite, so the same code runs a real database or a hermetic in-memory test. Backend, auth foundation, Sigma core, and rule API are done; ingestion, an in-process condition evaluator, ATT&CK coverage, and a Next.js UI are the roadmap.
05 · Security
Strictly defensive by construction: no collectors, agents, network reach, or remote execution — it only reads operator-supplied Sigma at rest. Rule parsing is bounded (safe YAML, size and nesting limits, pySigma validators) with no shell or subprocess in the path; ZIP imports are vetted for traversal, symlinks, entry counts, expanded size, and compression ratio; every rule route is default-deny behind analyst/admin RBAC; and the service refuses to start in production while the shipped example key is still in place.
Built with
Python 3.12+ · FastAPI · SQLAlchemy · PostgreSQL · pySigma · MITRE ATT&CK · Alembic · JWT · bcrypt
Notes
SentinelForge turns a folder of Sigma rules into a searchable, versioned, auditable library. Rules are validated with pySigma and graded by an explainable quality score across metadata, detection logic, ATT&CK mapping, false-positive guidance, references, tests, status, and description — so "is this a good rule?" gets an answer with reasons. Every edit is an immutable new version with a unified diff and restore-as-a-new-version semantics, and a bundled MITRE ATT&CK Enterprise v19.1 snapshot (15 tactics, 697 techniques) backs the mapping. Auth is real (JWT access with rotating refresh tokens, bcrypt, account lockout, login throttling, analyst/admin RBAC, audit logging) and persistence is PostgreSQL-native with a SQLite portability layer for local work and hermetic tests. Backend and rule API are done; event ingestion, an in-process Sigma evaluator with match explanations, ATT&CK coverage snapshots, incident replay, and a Next.js interface are the roadmap.