NetSentinel

Raw security events are noisy and difficult to act on when they arrive as disconnected logs with no workflow framing.

Security tools lose value when the interface makes it hard to see priority, context, and next action.

Local or small-team environments still need useful monitoring patterns, but not every setup needs enterprise-heavy complexity.

A Next.js frontend shaped around incident visibility, alert state, and operator-facing structure.

A FastAPI backend direction for event intake, transformation, and application logic.

SQLite persistence to support a local-first, practical monitoring setup.

A Suricata integration path using EVE log forwarding so telemetry can move into the platform workflow cleanly.

Suricata generates EVE events that are forwarded into the backend pipeline.

FastAPI receives and normalizes events before storing state in SQLite.

The frontend prioritizes dashboards, alert review, and incident-oriented navigation instead of dumping raw output.

The project is intentionally local-first so experimentation stays lightweight, fast, and realistic for smaller environments.

Kept the product local-first to reduce deployment overhead and focus on operator workflow quality first.

Chose lightweight persistence because this stage is about product clarity and event flow, not infrastructure complexity for its own sake.

Centered the interface around incidents and alerts so the UI reflects decisions, not just data ingestion.

Framed Suricata integration as a practical signal source that supports realistic monitoring direction.

Balancing technical credibility with interface clarity is harder than just showing charts and tables.

Security workflows need enough structure to feel dependable without turning the product into a cluttered analyst console.

The product is still evolving, so the architecture has to stay flexible while preserving a clear point of view.

NetSentinel is an evolving flagship build that best represents my direction in secure systems, operator visibility, and practical product engineering.

The current state demonstrates technical depth across the stack and a clear product narrative for where the platform is going next.

The next direction includes richer alert handling, better investigation views, and deeper workflow support around incidents.