Building GraphSentinel: Cybersecurity Investigation with FalkorDB

Building GraphSentinel: Cybersecurity Investigation with FalkorDB

Introduction

I built GraphSentinel, a graph-based cybersecurity investigation prototype using FalkorDB, Python, and Streamlit. The goal was to explore how graph databases can help investigate relationships between users, devices, and IP addresses.

The Problem

Security records can be difficult to investigate when information is scattered across multiple entries. Connecting a user to a device and an IP address can help investigators understand relationships between records.

Why FalkorDB?

FalkorDB allowed me to represent entities as nodes and their connections as relationships.

My graph model is:

"(User)-[:USED]->(Device)-[:CONNECTED_FROM]->(IP)"

Using Cypher, I can query connected entities instead of treating each record as an isolated row.

How GraphSentinel Works

The project imports security records from a CSV file into FalkorDB. A Streamlit dashboard displays the imported records, assigned risk levels, and user-device-IP relationships.

Key features include:

• CSV data ingestion
• Graph-based relationship queries
• Interactive user investigation
• User-device-IP visualization
• Suggested review actions based on assigned risk levels

Example Cypher Query

MATCH (u:User)-[:USED]->(d:Device)
-[:CONNECTED_FROM]->(i:IP)
RETURN u.name, u.risk, d.name, i.address

This query retrieves connected users, devices, and IP addresses for the dashboard.

Challenges and Learnings

Building GraphSentinel helped me understand graph modeling, Cypher queries, CSV ingestion, and connecting a graph database to a Python application.

I also learned that a locally running database cannot automatically be accessed by a cloud-hosted application through "localhost". A public deployment requires an accessible database and appropriate connection configuration.

Limitations

GraphSentinel is a prototype. Its risk labels are demonstration data, not verified threat intelligence. It does not independently prove that a user or IP address is malicious.

Future work could include authorized log integrations, evidence-based risk scoring, threat-intelligence sources, and detection of unusual graph patterns.

Conclusion

This project gave me practical experience with FalkorDB and showed me how connected data can support cybersecurity investigations.

GitHub: https://github.com/shreem-bhargava36/GraphSentinel

Technology: FalkorDB, Python, Cypher, Streamlit, Pandas, NetworkX, and Matplotlib.