SG/Sentinel: Learning From Standards, Open Source, And Threat-Intelligence Services
Summary
Compatibility over reinvention: tag rules with MITRE ATT&CK techniques (T1190 first), consume the OWASP Core Rule Set as a baseline layer via SecLang, study Coraza as the reference library-first engine, and speak STIX/TAXII for threat-intel feeds. The threat-intel service landscape is mapped (AbuseIPDB, GreyNoise, Spamhaus, OTX and others) with the critical caveat that reshaped the design: nearly 4 in 10 attacking IPs are now residential or compromised home connections, so IP reputation is context, never verdict. The zero-knowledge boundary is drawn explicitly: no malware or file-hash scanning at the Sentinel layers, ever — traffic, IP and behavioural intelligence only.
Key concepts
- Prior art, positioned — OPA, Sigma, CRS/Coraza, deception, zero-trust — what each contributed
- ATT&CK tagging — shipped in the MVP registry: every blocking rule carries its technique
- IP reputation is context, not verdict — the residential-proxy reality that killed per-IP keying
Key ideas
- Threat intel runs on the async timelines, feeding the evidence graph — Sentinel can afford rich enrichment precisely because it never needs it inline.
- The Sigma compile-to-backend model is the concrete mechanism for staying multi-CDN.
- Contribute back once patterns are proven — the de-commoditising strategy in reverse.
On this site
The prior-art table on the research page; the ATT&CK tags in the rules table; the deferred threat-intel row on the roadmap.