SentinelGraph：利用 FalkorDB 構建圖譜驅動的 AI 網絡安全調查智能體

SentinelGraph: Building a Graph-Powered AI Cybersecurity Investigation Agent with FalkorDB

How connected data can help security analysts investigate alerts, trace evidence, and make more explainable decisions.

The Problem: Security Alerts Don’t Exist in Isolation

Cybersecurity teams often deal with multiple alerts originating from different systems. Looking at each alert independently can make it difficult to identify relationships, understand the bigger picture, and determine whether several signals belong to the same incident.

An individual alert may appear harmless on its own. When connected to other alerts, evidence, and historical incidents, however, it may become part of a much more meaningful pattern.

This led me to build SentinelGraph, an AI-powered cybersecurity investigation agent designed to help security analysts explore relationships between alerts and understand the evidence behind an investigation.

The central idea is simple: instead of treating security alerts as isolated records, represent them as connected data and use those relationships to support investigation.

Introducing SentinelGraph

SentinelGraph is a graph-powered cybersecurity investigation system built around FalkorDB.

It helps investigators:

• Explore relationships between seemingly unrelated security alerts.
• Traverse multi-hop connections to uncover relevant context.
• Trace evidence paths that explain why alerts may be related.
• Retrieve historical incident memory for additional context.
• Understand why certain candidates are grouped together or excluded.
• Review recommended response actions before approving or rejecting them.

The goal is not to replace security analysts. It is to give them a clearer picture of the available evidence so they can make better-informed decisions.

Project repository: https://github.com/parnika0110/SentinelGraph

Live demo: https://frontend-production-717c.up.railway.app

Why FalkorDB?

A conventional approach might store alerts as individual database records and rely on separate queries to discover relationships. This can become difficult when an investigation requires following connections across multiple entities.

Graph databases provide a natural way to represent these relationships.

In SentinelGraph, FalkorDB serves as the core graph database. Rather than looking at alerts independently, the investigation workflow uses graph relationships to explore connected entities, follow evidence paths, and retrieve relevant historical context.

The graph is central to the investigation process—not simply a visualisation added to the interface.

This makes it possible to explain an investigation in terms of relationships and paths through connected data, rather than presenting a conclusion without showing how the available evidence supports it.

How the Investigation Works

The SentinelGraph workflow brings together graph exploration, evidence, historical context, and human review.

1. Start with security alerts

The investigation begins with a set of security alerts. For this demonstration, SentinelGraph uses synthetic security data, allowing the workflow to be explored without relying on real sensitive security information.

2. Explore connected relationships

The system uses FalkorDB to traverse relationships across the graph. Multi-hop traversal helps reveal connections that may not be obvious when each alert is considered independently.

These connections provide additional context for evaluating whether alerts may be related.

3. Examine evidence paths

A connection is more useful when an investigator can understand why it matters.

SentinelGraph exposes evidence paths to help explain the relationships supporting an investigation. This gives the analyst a way to inspect the connections behind a proposed grouping instead of relying entirely on an unexplained result.

4. Consider historical incident memory

Past incidents can provide useful context when investigating new alerts.

SentinelGraph retrieves historical incident memory to help connect the current investigation with relevant previous context. This adds another layer to the investigation beyond the immediate set of alerts.

5. Explain grouping and exclusion

Not every candidate should automatically be treated as part of the same incident.

SentinelGraph helps explain why candidates may be grouped together or excluded. Making these distinctions visible is important because an investigation tool should help analysts evaluate evidence rather than encourage blind trust in a generated conclusion.

6. Recommend actions with human oversight

After examining the available context, the system can recommend response actions.

These recommendations remain subject to human review and approval or rejection. The demonstration focuses on a controlled investigation workflow rather than silently executing real security remediation.

Architecture and Technology Stack

SentinelGraph combines a graph database, an API backend, and a web interface.

• FalkorDB: Stores connected investigation data and supports graph traversal.
• FastAPI: Provides the backend API for the investigation workflow.
• Next.js and React: Power the web application.
• TypeScript and Tailwind CSS: Support the frontend implementation and interface styling.
• React Flow (@xyflow/react): Supports graph-oriented visualisation in the investigation interface.

At a high level, the workflow is:

Security alerts → API and investigation logic → FalkorDB graph traversal → Evidence and historical context → Investigation results → Human-reviewed response recommendations

The frontend presents investigation context so the user can explore relationships and understand the reasoning behind the results.

Why Graph-Based Investigation Matters

The key benefit of using a graph is that relationships become part of the investigation itself.

Instead of asking only, “What does this alert say?”, an investigator can also ask:

• Which other entities are connected to this alert?
• What relationships link these alerts?
• Is there an evidence path supporting this connection?
• Does historical incident memory provide useful context?
• Why was one candidate included while another was excluded?

These questions encourage a more contextual approach to security investigation.

Graph traversal does not automatically guarantee that two alerts belong to the same incident. Its value is in helping surface relevant connections that can be examined and evaluated.

Safety and Human Oversight

Security tools need to be designed carefully because response actions can have real consequences.

SentinelGraph uses synthetic data for its demonstration. Its response workflow keeps a human approval step between recommendations and action selection.

This is an important design principle: an agent can help gather context, connect evidence, and recommend a next step without removing the analyst from the decision-making process.

The project is intended as a demonstration of graph-powered investigation, not a replacement for a production security operations platform.

What I Learned

Building SentinelGraph reinforced an important lesson about AI agents: the quality of an investigation depends on more than generating a plausible answer.

An investigation agent also needs access to relevant context, a way to follow relationships, evidence that can be inspected, and a workflow that allows people to review its recommendations.

FalkorDB provided the graph foundation for exploring these connected relationships. Combining it with an API backend and a web interface helped turn the underlying graph operations into an investigation workflow that users can interact with.

The project also highlighted the importance of making exclusions and uncertainty visible. In security investigations, explaining why something was not included can be just as useful as explaining why something was.

What's Next?

There are several directions in which SentinelGraph could be developed further:

• Integrating additional security data sources.
• Expanding graph-based investigation patterns.
• Improving evidence ranking and investigation explanations.
• Evaluating the system against larger and more varied datasets.
• Adding stronger evaluation metrics for investigation quality.
• Improving auditability around recommended and approved actions.

These are potential future improvements rather than claims about the current implementation.

Conclusion

SentinelGraph explores how graph databases can make AI-powered cybersecurity investigations more contextual and explainable.

By using FalkorDB to connect alerts, traverse relationships, trace evidence paths, and retrieve historical incident memory, the project demonstrates how connected data can support an investigation workflow. Human-reviewed response recommendations help keep analysts involved in consequential decisions.

The broader takeaway is that useful AI agents need more than a language model. They need structured context, meaningful relationships, inspectable evidence, and appropriate human oversight.

That is the idea behind SentinelGraph.

Explore the project:

• GitHub: https://github.com/parnika0110/SentinelGraph
• Live demo: https://frontend-production-717c.up.railway.app

Built for the FalkorDB Graph Hacks 2026 hackathon.