Architecture & Engineering Rationale
A technical breakdown of how Sentry Console achieves privacy-preserving threat detection across binary packet streams and static files.
1. System Architecture & Execution Boundary
Modern security triage tools frequently require uploading sensitive captures, confidential documents, or email evidence to cloud servers for parsing. Sentry Console was engineered to solve this privacy challenge by splitting execution into two distinct boundaries:
🔒 100% Client-Side Engine (Files)
PCAP captures, PDFs, Emails (.eml), Images, and Office documents are decoded in browser memory using HTML5 FileReader, ArrayBuffer, and Web Crypto APIs. Binary headers, MIME streams, EXIF structures, and ZIP containers never leave your device.
🌐 Backend Proxy Service (Network)
Live website assessments (Security Headers, TLS cert chains, DNS SPF/DMARC records) require network requests because browser CORS policies block raw socket inspection. A local Node.js proxy service executes server-side requests and returns findings to the UI.
Solutions by Security Role & Workflow
🛡️ For SOC Teams
Rapid initial triage of incoming suspicious PCAP packet dumps and email attachments. Eliminates wait times for sandbox detonation environments during early triage.
🚨 For Incident Responders
Extract malicious IPs, domain names, hashes, and EXIF metadata instantly. Generate print-ready PDF forensic reports for incident documentation.
🔬 For Students & Researchers
Learn low-level binary packet decoding (libpcap / pcapng format), PDF object dictionary parsing, and image steganography trailer offset verification.
💻 For IT & SysAdmins
Audit live web service security headers (HSTS, CSP, X-Frame-Options), SSL/TLS certificate chain validity, and DNS SPF/DMARC email security records.
Schedule a Sentry Console Platform Walkthrough
Learn how Sentry Console's client-side threat detection engine can fit into your enterprise SOC triage workflow or air-gapped security operations.
2. Detection Engine Methodology
Signature-based tools rely on static hash lookups or rigid YARA rules, which fail when encountering novel zero-day attacks or obfuscated files. Sentry Console uses **heuristic anomaly detection**:
- Rate & Sliding Window Thresholds: Flags port scans (≥15 distinct ports in 5s) and SYN floods (≥80 SYNs/s) based on traffic velocity.
- Structural & Stream Inspection: Inspects PDF catalog dictionaries for
/JavaScriptand/OpenActionexecution triggers regardless of file hash. - MIME Authentication Alignment: Evaluates From vs. Return-Path domains and HTML anchor text mismatches to catch spoofed phishing emails.
- Marker Offset Verification: Inspects JPEG/PNG binary trailers to detect steganography payloads appended past End-Of-Image signatures.
3. Behind the Build
Sentry Console was built as a hands-on security engineering project to demonstrate zero-dependency binary protocol parsing (classic libpcap & pcapng format decoding), static document forensics, and web auditing using pure ES modules, standard Web APIs, and vanilla JavaScript.
4. Frequently Asked Questions (FAQ)
Q: What file formats are supported?
Supported formats include network captures (.pcap, .pcapng), PDFs (.pdf), Email files (.eml, .msg), Images (.jpg, .png, .gif), Office documents (.docx, .xlsx, .pptx), and generic binary artifacts.
Q: Is my uploaded data ever transmitted to a remote cloud?
No. File threat analysis runs 100% locally inside your browser's memory using JavaScript Web File APIs. No telemetry, file bytes, or hashes are transmitted.
Q: Is Sentry Console a replacement for enterprise SIEM or IDS tools?
No. Sentry Console is a fast triage, forensic investigation, and educational tool designed for rapid analyst response and learning — not a certified 24/7 enterprise intrusion detection system.