Adrien Lachambre

SENTINEL is a terminal-native security investigation workspace for administrators and small security teams. It imports CSV and JSONL logs, detects transparent signals, and uses Meta models to investigate through real MCP tools. Analysts can follow accounts, IPs, hosts and sessions, inspect original records, distinguish observed facts from hypotheses, export reports and resume saved cases. The included dataset contains 3,542 fictional events and both suspicious and legitimate activity. The demonstration includes an actual Meta investigation with nine MCP tool calls and 27 retained evidence events. Storage runs locally; selected evidence excerpts are sent to Meta during live investigations.