Understanding SentinelOps: Building an AI Security Agent with Organizational Memory

Tirumalesh — Sat, 07 Nov 2026 13:50:24 +0000

Understanding SentinelOps: Building an AI Security Agent with Organizational Memory

What if a security investigation could benefit from the lessons learned during previous incidents?

Security teams regularly deal with alerts involving suspicious processes, unusual network activity, malware, and potential system compromises. Investigating each alert requires time, technical knowledge, and careful analysis. When a similar incident occurs again, information from previous investigations can be extremely valuable.

This idea inspired SentinelOps, an AI-powered security incident investigation system designed to make security investigations more context-aware by using historical incident knowledge.

While exploring this project, I became particularly interested in how AI agents can use information from previous investigations instead of treating every new alert as an isolated problem.

In this article, I'll explain the problem SentinelOps addresses, its architecture, how its AI and memory components work together, and what I learned while researching the project and understanding its implementation.

1. The Problem: Investigating Every Alert from Scratch

Imagine a security operations team investigating suspicious PowerShell activity on a financial server.

An analyst investigates the alert, identifies the suspicious behavior, determines the root cause, and records the remediation steps.

A few days later, a similar alert appears on another server.

The team may already have useful information from the earlier investigation. However, if that information is not available during the new investigation, the analyst may need to repeat much of the previous work.

This raises an interesting question:

How can an AI security assistant make useful historical investigation knowledge available when a new alert arrives?

SentinelOps explores this problem by combining AI-powered investigation with persistent organizational memory.

2. Introducing SentinelOps

SentinelOps is an AI-assisted security incident response application.

Its purpose is to help security analysts investigate alerts using both current incident information and relevant historical knowledge.

The application includes several major sections:

Overview: Displays incident statistics, severity levels, and recent security activity.
Incident Center: Provides access to security incidents and their details.
AI Investigation: Supports AI-assisted analysis of security alerts.
Organizational Memory: Provides access to retained incident knowledge.
Learning Analytics: Presents information related to historical memory and investigation activity.

The main idea is to connect previous investigation outcomes with new security alerts.

3. Understanding the System Architecture

One of the most interesting parts of exploring SentinelOps was understanding how its different technologies work together.

The project uses:

React: Builds the interactive frontend.
TypeScript: Provides type-safe application development.
Node.js and Express: Handle backend logic and API requests.
Google Gemini: Supports AI-powered incident analysis.
Hindsight: Provides persistent memory capabilities.
Vite: Supports frontend development and building.
Tailwind CSS: Helps style the user interface.

The backend coordinates communication between the incident store, Gemini, and Hindsight.

At a high level, the workflow looks like this:

A security alert enters the application.
The backend validates and stores the incident.
The application searches for relevant historical memories.
Retrieved information is provided to Gemini along with the current alert.
Gemini generates an investigation result.
An analyst reviews the findings and submits feedback.
The investigation outcome can be retained for future use.

This separation is important because the memory system provides historical context, while the AI model analyzes the current incident.

4. Why Persistent Memory Matters

A normal AI conversation does not automatically provide an application with access to every previous investigation.

If an AI assistant receives only the latest alert, it may lack important information about earlier incidents.

This is where Hindsight, developed by Vectorize, becomes important in SentinelOps.

Hindsight provides a memory layer that allows an AI application to retain information, retrieve relevant memories, and synthesize information across stored memories.

The three operations I explored are:

Retain

Retain stores useful information from a completed investigation.

In SentinelOps, the application prepares incident information such as:

Incident description
Analyst verdict
Root cause
Remediation actions
Analyst notes
Relevant process information

The backend then sends this information to Hindsight.

Recall

Recall retrieves relevant historical information when a new investigation begins.

For example, if a new alert contains suspicious PowerShell activity, the application can search for previous incidents involving similar behavior.

The retrieved memories can then provide additional context for Gemini's investigation.

Reflect

Reflect supports broader questions that require synthesizing information across stored memories.

For example, an analyst might ask:

"What recurring attack techniques and service account compromises have appeared in previous incidents?"

This is different from simply retrieving one similar incident. It aims to identify broader patterns across organizational knowledge.

Together, Retain, Recall, and Reflect make historical information useful throughout the investigation workflow.

5. Understanding the Implementation Through Code

While exploring the repository, I found it useful to follow the backend workflow to understand where memory retrieval happens.

The following examples are shortened excerpts from the project's server.ts file.

Retrieving historical memories

When an investigation starts, the backend first creates a recall query and requests relevant memories from Hindsight.

const recallQuery = buildMemoryRecallQuery(incident.alert);

const hindsightResult =
  await hindsightService.recall(recallQuery);

let recalledMemories = hindsightResult.memories;

The application also includes a local-memory fallback when Hindsight does not return memories:

if (recalledMemories.length === 0) {
  recalledMemories = incidentStore.searchLocalMemories(
    incident.alert,
    incident.id
  );
}

This is an important implementation detail. The application can continue with locally stored historical information when the Hindsight retrieval does not provide results.

Passing memory into Gemini

After retrieving historical information, the application provides it to Gemini during incident analysis.

const analysis = await geminiService.analyzeIncident(
  incident.alert,
  recalledMemories
);

This demonstrates the central idea behind SentinelOps: the AI investigation receives both the current alert and available historical context.

Retaining analyst feedback

Once an analyst submits feedback, the application prepares an incident summary and sends it to the memory service.

const hindsightRetainResult =
  await hindsightService.retain(memoryContent, metadata);

This creates a feedback loop:

Investigate → Review → Retain → Recall → Investigate again.

These examples helped me understand how the different components connect, even though the implementation of these integrations was handled by my teammate.

6. A Practical Example: FIN-SRV-04 and FIN-SRV-07

The project demonstrates the memory workflow using two related security incidents.

The first incident involves suspicious PowerShell execution on FIN-SRV-04.

After investigation, the outcome and remediation information are retained in Hindsight.

Later, another suspicious PowerShell incident appears on FIN-SRV-07.

Instead of analyzing the new alert without historical context, SentinelOps attempts to retrieve relevant information from the earlier investigation.

That information can help Gemini understand what the team previously observed and what actions were taken.

However, historical similarity does not automatically prove that two incidents have the same root cause. The current evidence still needs to be investigated, and the analyst remains responsible for reviewing the findings.

This example helped me understand why persistent memory can be useful in security operations.

7. Keeping Human Analysts in the Loop

AI assistance should not mean removing human responsibility from security investigations.

SentinelOps is designed to support analysts by providing investigation findings and response recommendations.

An analyst can review the result, provide feedback, and record the final investigation outcome.

This is important because security decisions can have serious consequences. Recommendations involving account access, network isolation, or other operational actions should be reviewed by authorized people.

The objective is to make investigations more informed, not to replace security professionals.

8. What I Learned from This Project

My contribution to SentinelOps focused on project research, understanding the system architecture and implementation, coordinating with my teammate, and presenting a demonstration of the website.

After my teammate completed the Hindsight integration, I explored how its Retain, Recall, and Reflect operations worked within the application.

This experience helped me understand several concepts:

First, an AI application needs more than a language model. The surrounding architecture, data flow, and memory layer are important parts of building a useful AI agent.

Second, historical context can change how an AI system approaches a problem. Providing relevant information from previous investigations gives the model additional context instead of asking it to work only with the latest alert.

Third, different components need clear responsibilities. Gemini handles AI-powered analysis, while Hindsight provides the memory capabilities used by the application.

Finally, understanding a project is just as important as presenting its features. Exploring the architecture and following the workflow helped me explain what happens behind the interface during the demonstration.

9. What Could Be Improved?

SentinelOps is a prototype, and there are several areas that could be improved in future development.

Some important areas include:

Moving beyond local JSON incident storage to a database suitable for concurrent access.
Improving authentication and authorization.
Expanding error handling and integration testing.
Making the source of retrieved information more visible to analysts.
Testing memory retrieval across a wider range of security incidents.
Evaluating whether historical context consistently improves investigation quality.

These improvements would help make the system more reliable and suitable for more demanding security environments.

Conclusion

SentinelOps explores an interesting direction for AI-powered security operations: building an assistant that can use knowledge from previous investigations.

The most important idea I took away from this project is that an AI agent should not always have to start from zero. Previous investigations can provide useful context for future decisions when that information is stored and retrieved appropriately.

Exploring the architecture, understanding the Hindsight integration, coordinating with my teammate, and presenting the application gave me a better understanding of how AI, backend services, and persistent memory can work together.

The goal is simple: make security investigations more context-aware by allowing useful organizational knowledge to carry forward.

Project: SentinelOps

GitHub: SentinelOps Repository

DEV Community: Tirumalesh

Understanding SentinelOps: Building an AI Security Agent with Organizational Memory