jaguar

**ZeroDay Sentinel – Evidence-Based Cybersecurity Investigation Engine** Security teams face a major challenge: security alerts do not always tell the full story. A suspicious PowerShell execution, for example, could represent a legitimate IT operation or an actual compromise. Traditional alert classification often fails to communicate the evidence behind a decision or what information is still missing. ZeroDay Sentinel addresses this problem through a defensive cybersecurity investigation engine designed to evaluate security alerts using structured evidence correlation. Instead of relying exclusively on severity labels, the engine evaluates supporting and contradicting evidence, assesses reliability, identifies critical information gaps, and produces explainable security verdicts. Our working MVP demonstrates two important investigation outcomes: • BENIGN: A suspicious PowerShell execution supported by authorized change-control evidence and a verified internal script baseline. • MALICIOUS: A compromised-host scenario supported by multiple independent endpoint, network, and process observations. Each investigation generates a structured report containing the verdict, confidence status, evidence references, missing information, defensive limitations, and recommended next investigative checks. An important design principle is that the engine must recognize the limits of available evidence rather than pretend to know more than it does. Currently, ZeroDay Sentinel is a functional Python backend prototype using deterministic analysis and synthetic security scenarios. Our next development stage is to introduce Meta-powered contextual reasoning, an agentic investigation workflow, and a visual interface. Our vision is to make security investigations more explainable, evidence-driven, and accessible to security analysts.