by LeafCore Labs
SENTRIX
Sentri-X by LeafCore LabsA production defense OS — not another SIEM dashboard.
Predict, detect, understand, respond, recover, and learn across your estate with specialist agents coordinated by Helix Neuralix.
Positioning
Not a SIEM. A defense operating system.
Sentri-X is LeafCore’s cyber adaptation of Helix Neuralix — the live agent control plane. It runs an autonomous defense loop end to end, instead of dumping alerts into another dashboard for humans to chase.
SIEM dashboards
Centralize logs and alerts. Analysts still stitch context, decide, and act.
Sentri-X
Coordinates specialist agents that predict, detect, understand, respond, recover, and learn — in production.
Defense loop
Helix Neuralix for cyber
The live agent control plane, adapted for defense.
Helix Neuralix is LeafCore’s live agent control plane. Sentri-X adapts that same topology — agents, models, loops, and memory — for cyber defense operations.
Mission Control
One plane for defense operations.
01
Live defense topology
02
Specialist agent mesh
03
Autonomous response playbooks
04
Threat knowledge graph
05
Digital twin simulation
06
Learning & feedback loops
07
Asset & vulnerability context
08
Executive briefings
Topology
Layers that keep the defense loop alive.
Sensors
Ingest signals from identity, cloud, network, endpoint, and application surfaces.
Loops
Closed defense cycles that move from prediction through recovery and learning.
Agents
Specialist operators that hunt, analyze, advise, and act with shared context.
Core
Orchestration and mission control that routes work across the mesh.
Models
Reasoning and routing for detection, triage, and response decisions.
Memory
Graph, vector, and operational memory that compounds institutional knowledge.
Specialist roster
Nineteen specialists. One orchestrator.
Domain agents cover the cyber kill chain and the operating rhythms of a modern SOC — coordinated as a single defense mesh.
Orchestrator
01
Threat Hunter
02
SOC Analyst
03
Threat Intelligence
04
Malware Analyst
05
Cloud Security
06
Identity Security
07
Network Security
08
DFIR
09
Compliance
10
Risk
11
Executive Advisor
12
Knowledge Graph
13
Learning
14
Attack Simulation
15
Response
16
Patch Intelligence
17
Asset Discovery
18
Vulnerability
19
Security Copilot
Services architecture
Ten services. Clear boundaries.
Gateway
Edge entry for APIs, auth handoff, and tenant routing.
Identity
Tenancy, roles, and access control for operators and agents.
Ingest
Signal intake from sensors and connected security tooling.
Pipeline
Normalization, enrichment, and event flow into detection.
Graph
Relationship memory across assets, identities, and threats.
Detect
Detection logic that feeds specialist understanding.
Agents
Runtime for the specialist mesh and orchestrator.
Response
Playbook execution and controlled containment actions.
Twin
Simulation surface for attack paths and recovery rehearsal.
Workers
Async jobs for heavy analysis, crawling, and long-running tasks.
Architecture
Repo-accurate stack for the Operator OS.
Sentri-X v0.1.0 · Apache-2.0 · Python 3.11+ · Node 22+
Data plane
Postgres 16
Identity, tenants, LangGraph checkpoints, relational state with RLS.
ClickHouse
Analytics and enriched security events.
Neo4j
Knowledge graph, attack paths, and blast radius.
Qdrant
Vector memory and RAG for specialist context.
Redis 7
Cache, bus helpers, and Celery broker / results.
MinIO
S3-compatible object storage.
Tech stack
| Layer | Technology |
|---|---|
| Monorepo | pnpm · Turborepo · uv · TypeScript 5.9 · Python 3.11 |
| Frontend | Next.js 16 · React 19 · Tailwind 4 · @xyflow/react · motion · cmdk |
| Gateway | FastAPI · Strawberry GraphQL · WebSocket · auth proxy |
| Services | Identity · Ingest · Pipeline · Graph · Detect · Agents · Response · Twin · Workers |
| AI | LangGraph · LangChain · Groq · fastembed · capability-role router |
| Data | Postgres · Redis · ClickHouse · Neo4j · Qdrant · MinIO |
| Streaming | Redpanda (Kafka-compatible) |
| Shared libs | sx-core · sx-schemas · sx-data · sx-ai |
| Contracts | Pydantic → OpenAPI → @sentri-x/contracts |
| Observability | OpenTelemetry · structlog · Prometheus / Grafana-ready |
Security & tenancy
Designed for controlled, multi-tenant defense ops.
How it works
From sensors to autonomous recovery in three steps.
Connect sensors & identity
Bring in estate signals and operator access so Sentri-X can see the surface it must defend.
Activate the defense loop
Specialists coordinate through Helix Neuralix — predicting, detecting, understanding, and preparing response.
Respond, recover, learn
Mission Control executes playbooks, recovers state, and feeds outcomes back into memory and models.
SENTRIX
Run cyber defense as an operating system.
Request access to Sentri-X, or explore Helix OS to see the Neuralix control plane that powers it.
Powered by Helix Neuralix by LeafCore Labs