100% Client-Side Privacy Packet captures and evidence files never leave your browser memory. See how zero-trust privacy works →
Book a Demo ⚡ Start Analyzing

Sentry Console Technical Reference

Welcome to the technical documentation for Sentry Console. This reference documents the underlying binary parsing pipeline, deterministic heuristic detection rules, exact detection thresholds, REST API specifications, and operational incident response workflows.

Specification Version: 1.2.0 Last updated: 2026-08-13

Engine Architecture Whitepaper

Sentry Console processes network traffic and static files using a zero-dependency deterministic pipeline. Binary network captures are decoded directly from JavaScript ArrayBuffer memory buffers using custom endian-aware DataViews.

1. Endian-Aware Binary Parsing Pipeline

Classic libpcap captures start with magic bytes 0xa1b2c3d4 (Little-Endian) or 0xd4c3b2a1 (Big-Endian). The parser inspects the magic number dynamically to set DataView byte-swapping getters:

const firstWordLE = dv.getUint32(0, true); const le = (firstWordLE === 0xa1b2c3d4); const r16 = (o) => dv.getUint16(o, le); const r32 = (o) => dv.getUint32(o, le);

2. Deterministic Heuristics vs. Machine Learning Tradeoffs

Sentry Console intentionally uses deterministic rate and pattern matching heuristics instead of black-box Machine Learning models:

  • Precision & Predictability: Heuristic thresholds produce zero non-deterministic hallucinations. Every alert maps to explicit packet counters or stream regex patterns.
  • Zero Training Overhead: Operates instantly in-browser without downloading multi-megabyte model weights or requiring server GPU inference.
  • Tradeoff & Evasion Limitation: Low-and-slow attacks (e.g. 1 port probe every 60 seconds) will bypass sliding window thresholds (5.0s window). High-throughput legitimate vulnerability scanners (Nessus, Qualys) can trigger false positive alerts on internal subnets.

Network Traffic Analysis Rules (PCAP / PCAPNG)

NET-01: TCP Port Scan Detection

CRITICAL MITRE ATT&CK: T1046

Detects rapid network probing of multiple ports on target hosts from a single originating source IP.

Source Code Implementation & Thresholds:

// Source: src/detection.js (detectPortScan) const WINDOW_SEC = 5.0; const PORT_THRESHOLD = 15; if (distinctPorts.size >= PORT_THRESHOLD && (timeWindow <= WINDOW_SEC)) { findings.push({ id: 'port-scan', severity: 'critical', srcIP, dstIP, count: distinctPorts.size }); }

Trigger Conditions:

  • Source IP initiates connections to ≥ 15 distinct destination ports within any 5.0 second window.

False Positives & Evasion:

Authorized security vulnerability scanners (Nmap, Masscan) will trip this rule. Evasion: Slow stealth scans executing < 15 ports per 5 seconds bypass detection.

Remediation Workflow:

1. Verify if originating source IP belongs to an authorized vulnerability scanner.
2. Block unauthorized external IPs at perimeter firewall.

NET-02: TCP SYN Flood / DDoS

CRITICAL MITRE ATT&CK: T1498.001

Detects high-volume TCP SYN packet bursts designed to exhaust target connection queues (SYN-RECEIVED state).

// Source: src/detection.js (detectSynFlood) const RATE_THRESHOLD = 80; // SYNs per second const RATIO_THRESHOLD = 0.30; // Max 30% handshake completion if (synRate >= RATE_THRESHOLD && ackRatio <= RATIO_THRESHOLD) { findings.push({ id: 'syn-flood', severity: 'critical', dstIP, synRate }); }

Trigger Conditions:

  • Target host receives ≥ 80 TCP SYNs/second with ≤ 30% ACK completion ratio.

NET-03: ICMP Echo Flood

HIGH MITRE ATT&CK: T1498.001
// Source: src/detection.js (detectIcmpFlood) const ICMP_RATE_THRESHOLD = 40; // Echo Requests/sec if (icmpRate >= ICMP_RATE_THRESHOLD) { findings.push({ id: 'icmp-flood', severity: 'high', dstIP, icmpRate }); }

NET-04: Credential Brute Force

CRITICAL MITRE ATT&CK: T1110
// Source: src/detection.js (detectBruteForce) const SENSITIVE_PORTS = [22, 21, 23, 3389, 445, 1433, 3306]; const ATTEMPT_THRESHOLD = 15; if (SENSITIVE_PORTS.includes(dstPort) && synAttempts >= ATTEMPT_THRESHOLD) { findings.push({ id: 'brute-force', severity: 'critical', srcIP, dstPort }); }

NET-05: ARP Cache Poisoning

CRITICAL MITRE ATT&CK: T1557.002
// Source: src/detection.js (detectArpSpoofing) if (ipToMacMap[claimedIP].size >= 2) { findings.push({ id: 'arp-spoofing', severity: 'critical', ip: claimedIP, macs: Array.from(macSet) }); }

File-Based Threat Detection Rules

FILE-PDF-01: PDF Embedded Scripting

CRITICAL MITRE ATT&CK: T1059.007
// Source: src/modules/pdf_analyzer.js const hasJS = /\/JavaScript|\/JS\b/gi.test(pdfString); const hasOpenAction = /\/OpenAction\b/i.test(pdfString); const hasLaunch = /\/Launch\b/i.test(pdfString);

FILE-EML-01: Email Sender Spoofing

CRITICAL MITRE ATT&CK: T1566.001
// Source: src/modules/eml_analyzer.js if (fromDomain !== returnPathDomain) { findings.push({ id: 'EML-CRIT-SPOOF-RETURNPATH', severity: 'CRITICAL' }); }

Backend API Specification

POST /api/scan/url

Runs server-side website security assessment for target URL.

// Request Payload: { "url": "https://example.com" } // Response (200 OK): { "score": 59, "riskLevel": "HIGH RISK", "findings": [...], "iocs": { "domains": ["example.com"], "ips": ["104.20.23.154"] } }

Version History & Changelog

v1.2.0 (2026-08-13) — Multi-Page Architecture, Persistent Navbar, Enterprise Technical Documentation System.
v1.1.0 (2026-08-13) — Multi-Format Engine (.pcapng, PDF, EML, Images, Office Docs), Universal Security Score (0-100), Node.js Domain Scan Backend.
v1.0.0 (2026-08-13) — Initial Sentry Console release: Classic PCAP binary parser, 7 attack detectors, dark SOC UI.