SentinelMesh

SentinelMesh is an autonomous multi-agent cybersecurity system built for the AMD Developer Hackathon (Track 1: AI Agents and Agentic Workflows). It detects, classifies, correlates, and responds to cybersecurity threats in real time using four specialised AI agents orchestrated via CrewAI on AMD Instinct MI300X GPUs. The system ingests live syslog data from Apache Kafka at 2.4 TB/s and passes it through a pipeline of autonomous agents. LogHarvester parses raw CEF and syslog streams into normalised event records. ThreatClassifier scores each event using DeepSeek-R1 70B, mapping threats to MITRE ATT&CK STIX T-codes with confidence scores. CorrelationEngine links classified events into full kill chains and builds real-time threat topology graphs. IncidentWriter auto-drafts incident response reports and pushes containment playbooks to downstream SOAR tooling. Running on AMD Instinct MI300X with 192 GB HBM3 unified memory, the system can hold the entire log history in-context during LLM inference. This eliminates the chunking and truncation that causes missed threat correlations on consumer hardware. LLM inference latency is 42ms per cycle. The backend is built on FastAPI with PostgreSQL, Redis, and Kafka, all containerised via Docker Compose. The frontend is a multi-page SOC-style dashboard built in React and Vite, with four views: Mesh Agents, Incident Tracker, Threat Topology Map, and Live Log Explorer. Threat intelligence is enriched via MITRE ATT&CK STIX/TAXII, VirusTotal API, and AbuseIPDB. In a live test, SentinelMesh autonomously traced a kill chain from an external C2 node through an API gateway to a production database, classified it as MITRE T1078 (Valid Accounts), and produced the incident report with 98.4% LLM confidence. Stack: CrewAI, LangChain, DeepSeek-R1 70B, ROCm 6.x, PyTorch, Apache Kafka, FastAPI, PostgreSQL, Redis, MITRE ATT&CK STIX, React, Vite, Docker Compose.