Sentinel is a custom NIDS/NIPS built with Python and Scapy. It features real-time packet sniffing, volumetric DoS detection, persistent CSV threat logging, automated Linux firewall (iptables) mitigation to actively block attacks, and live SIEM integration with Splunk for real-time threat telemetry and SOC dashboard visualization.

This IOC case revolves around a Wi-Fi compromise, where an attacker leveraged weak network defenses to gain unauthorized access. The initial detection came from AP logs identifying an unrecognized MAC address joining the network, accompanied by a suspicious WPA2 authentication event.