SentriScope Intelligence Architecture

1. Overview

The Intelligence architecture covers three interconnected domains:

1. Global Intelligence Dashboard — Operator-facing prioritization surface that aggregates canonical data into ranked attention points.
2. Threat Intelligence Platform — CTI lifecycle management, threat actor profiling, IOC correlation, and intelligence-to-risk influence.
3. Threat Intel Feed API — Platform-level news feed with tenant subscriptions.

2. Global Intelligence Dashboard

2.1 Purpose

The Global Intelligence Dashboard (/ endpoint, tenant-facing) gives security operators a single consolidated view of where to focus. It aggregates:

• Technology context: CMDB-derived assets, vulnerabilities, security coverage, exposure lifecycle
• Threat intelligence: Tenant-owned CanonicalThreatIntelItem, platform feed articles, CVE reference data
• Correlated risk: Latest RiskSnapshot, RiskSnapshotItem, exposure–asset–vulnerability links

Key design: The dashboard does not replace list/detail UIs. It sits on top as a prioritization and triage entry point.

2.2 Operator-Driven → System-Driven Intelligence Shift

2.3 Attention Points

Each attention point carries:
- priority_score: Deterministic 0–100 computed from risk, threat intel, and coverage data
- reason_codes: Why this item appears (e.g. CRITICAL_CVE_ACTIVE_TI, COVERAGE_GAP, LONG_LIVED_EXPOSURE)
- evidence_refs: Links to canonical entities (exposure ID, asset ID, TI item ID)
- recommended_action: Suggested remediation or investigation step

Deterministic scoring: No LLM in the critical attention-point computation path.

Attention points emit canonical Intelligence Insights via apps/intelligence_insights/adapters/attention_point_adapter.py (read-only mapping; scoring unchanged). See IMPLEMENTATION_INTELLIGENCE_INSIGHT_PLATFORM.md.

2.4 SOAR Readiness

The architecture is designed for future SOAR integration:
- Attention points can link to RemediationPlaybook (human-in-the-loop)
- Deterministic scoring remains the source of truth
- Automation consumes the same attention-point stream

2.5 Data Sources (Read-Only)

The dashboard consumes existing canonical data — it does not modify models or ingestion logic:

3. Threat Intelligence Platform

3.1 CTI Lifecycle Model

CanonicalThreatIntelItem follows a formal CTI lifecycle:

Transitions are auditable. Only authorized roles may change lifecycle state. Archived items are excluded from risk weighting.

3.2 Intelligence Tier Model

Tier is stored in CanonicalThreatIntelItem.intelligence_tier and CanonicalIntelAssessment.intelligence_tier.

3.3 Intelligence Source Types

3.4 Threat Intelligence Risk Influence Model

Intel items influence risk scoring via IntelWeightFactor:

IntelWeightFactor = source_type_weight × tier_weight × confidence × decay_factor

RiskScoringProfile extended with:
- intel_source_weight_map: Weight per source type
- intel_tier_weight_map: Weight per intelligence tier
- intel_confidence_multiplier: Scaling factor for confidence
- decay_enabled: Whether expired intel is excluded

3.5 Intelligence Validity and Decay

• valid_from / valid_until — Explicit validity window
• decay_rate — Rate at which intel relevance decreases after valid_from
• Expired intel (valid_until < now) is excluded from risk calculations
• Decay is deterministic — identical parameters produce identical decay values

4. Threat Actor and Campaign Profiling

4.1 CanonicalThreatActor

4.2 IOC Correlation

CanonicalIOC is correlated with:
- CanonicalThreatActor via CanonicalIOCThreatActor
- CanonicalCampaign via CanonicalIOCCampaign
- CanonicalIncident via IOCContextCorrelation and CanonicalIntelEdge

Correlations appear in the Attack Graph as edge types (see ).

5. Produced Intelligence: CanonicalIntelAssessment

CanonicalIntelAssessment is produced intelligence — an analyst's conclusion linking raw intel items to tenant assets and risks:

CanonicalIntelAssessment is LLM-queryable and auditable. All changes are audit-logged.

6. Security Validation Events

CanonicalSecurityValidationEvent records active validation and adversarial testing results:

Fields: detection_success, time_to_detect, time_to_respond, linked controls and exposures. All events are tenant-scoped and auditable.

7. Threat Intel Feed API

7.1 Architecture

Platform-level FeedArticle records are published to subscribed tenants via TenantFeedSubscription.

7.2 Intelligence Newsfeed API

GET /api/v1/intelligence/feed/                 List feed articles (tenant-subscribed)
GET /api/v1/intelligence/feed/<id>/            Article detail
POST /api/v1/intelligence/feed/<id>/correlate/ Correlate article with tenant IOCs
GET /api/v1/intelligence/actors/               Threat actor list
GET /api/v1/intelligence/iocs/                 IOC list with correlation status

All endpoints are tenant-scoped. Platform feed articles are read-only from tenant perspective.

8. Threat Intel Graph Analytics

Threat intel entities are connected via CanonicalIntelEdge:

Graph analytics queries traverse these edges to discover:
- Which threat actors are relevant to the tenant's asset profile
- Which ongoing campaigns target the tenant's sector
- Which IOCs have been observed against the tenant's assets

9. Investigation Platform Evolution

9.1 Relationship to Attack Path Intelligence

The Intelligence architecture is evolving from dashboard + CTI into a unified Operator Investigation Platform. Attack Path Intelligence (ARCHITECTURE_ATTACK_PATH_INTELLIGENCE.md) extends the dashboard with technology attack chains; this document's CTI graph analytics extend investigation for threat entities.

9.2 Dashboard as investigation entry point

Security Pulse (apps/intelligence_dashboard) remains the primary operator entry. Planned evolution:

• Integrate Attack Path Intelligence priority widgets (critical assets, chains, crown jewel exposure)
• Extend attention point reason_codes with path-derived codes (see Attack Path Intelligence architecture §6.3)
• Preserve deterministic scoring — no LLM in widget computation

Design shift: Dashboard answers “what should I investigate?”; entity pages answer “what does this mean for this asset/identity/app?”; graph viewer supports both contextually.

9.3 Investigation workflow (target)

Dashboard → Critical entity → Evidence → Attack path → Relationships
    → Timeline → Pivot → Response

See DESIGN_ATTACK_PATH_INVESTIGATION_UI.md for component standards.

9.4 Intel Graph Explorer positioning

/intelligence/graph/ remains the CTI neighborhood explorer. It is complementary, not replaced by Attack Graph. Unified investigation UI presents CTI pivot and attack path panels side-by-side on relevant entity pages (IOC, actor, campaign with tenant asset touchpoints).

Related Articles

• SentriScope Attack Graph Architecture
• SentriScope Connector Architecture