home / projects / sentinel-ops

Sentinel-Ops

Active DevOps & AI

Agentic IT Support & Log-Driven Auto-Remediation Engine

Enterprise-grade Cloud-LLM (DeepSeek) & Local-Vision (InsightFace ArcFace) AI kiosk agent. Automates L1/L2 IT support (app provisioning, VPN cert installs, log-based troubleshooting) via text log diagnostics, ChromaDB RAG, WinRM remote laptop remediation protected by a 20+ regex safety blocklist, and MS Teams Adaptive Cards with HMAC-verified JIT approval.

PythonFastAPIDeepSeek APIInsightFace ArcFaceChromaDBWinRMMS Teams APITkinterDocker
View on GitHub

// key_features

Two-Phase WinRM Log Diagnostics & Fix

Phase 1 analyzes diagnostic logs automatically (read-only). Phase 2 generates an admin-reviewed fix plan before executing PowerShell remediation via WinRM.

20+ Safety Regex Blocklist

Rigorous command validation blocking recursive deletion, privilege escalation, Defender disabling, credential dumping, and execution policy bypasses.

MS Teams JIT Approval + HMAC

Pushes Adaptive Cards to MS Teams for IT Manager approval with HMAC-signed token verification preventing replay attacks.

InsightFace ArcFace Local Vision

Extracts 512-d facial embeddings locally via ONNX with identity frame caching (~87% inference reduction) for real-time user recognition.

DeepSeek Prompt Caching & Intent Routing

Uses static system prompts (50x cost reduction via prompt cache) and structured JSON intent routing for zero-latency tool execution.

ChromaDB RAG Knowledge Base

Ingests enterprise PDFs & Markdown section-chunked guides into a local ChromaDB vector store for precise IT query resolution.

// architecture_highlights

→ 👀 EYES (Local Vision): InsightFace ArcFace (buffalo_s) extracts 512-d embeddings via ONNX to recognize enrolled users.
→ 🧠 BRAIN (Agentic LLM): DeepSeek API parses user intent into JSON actions (enroll_face, trigger_remote_support, trigger_jit_admin). Static system prompts achieve ~50x prompt caching cost reduction.
→ 🛡️ SAFETY & SECURITY: WinRM commands pass through a 4-layer defense-in-depth safety engine (Static Prompt -> 20+ Regex Blocklist -> Admin Approval -> Service Scope).
→ 💬 INTEGRATIONS: MS Teams Adaptive Cards with HMAC signature verification for JIT Admin and Remote Fix Plan approvals. Full SQLite audit log tracking.