Introducing Sentrios: The Danish Compliance-First SIEM

Why We Built Sentrios

The European security landscape has changed. NIS2 Article 21 mandates risk-based security measures. Article 23 sets 72-hour incident reporting windows. GDPR Article 32 requires demonstrable technical controls. ISO 27001:2022 Annex A demands an auditable control library.

Most SIEM platforms treat these obligations as an afterthought: a plugin here, a report template there. We built Sentrios to answer a single question from the ground up: what does a security platform look like if compliance is the core, not the wrapper?

The Sentrios Engine

The Sentrios Engine is written entirely in Rust. 12 workspace crates, approximately 37,000 lines of Rust, 592 passing tests. It runs as a single Docker container. No distributed cluster. No Java heap tuning.

The engine ships with:

• 125+ detection rules across 22 YAML files, each tagged to MITRE ATT&CK tactics and the compliance controls they evidence
• Multi-event correlation that links related events across hosts and time windows to surface attack chains
• Kill chain analysis from Reconnaissance through Exfiltration
• 32 decoders for common log formats, feeding a 110+ endpoint REST API

5-Phase Vulnerability Scanner

Unlike Wazuh, QRadar, and Splunk, Sentrios includes a full active vulnerability scanner. No Nessus or Qualys license required.

Phase 1: Network Reconnaissance. ARP/ICMP/TCP host discovery, OS fingerprinting via TCP/IP stack analysis, 6 configurable timing profiles. Written in pure Rust using pnet and socket2.

Phase 2: Service Intelligence. Protocol-aware probing across 20+ protocols (HTTP, SSH, SMB, RDP, LDAP, Redis, MongoDB, Modbus, and more). 206 service signatures ship out of the box. NVD API 2.0 live sync with full CPE matching engine with sub-millisecond CVE lookup across 250K+ CVEs stored in RocksDB. TLS deep analysis checks for Heartbleed, POODLE, BEAST, DROWN, ROBOT, and 5 other known vulnerabilities.

Phase 3: Authenticated Assessment. SSH, WinRM, SNMP, Docker API, and Kubernetes API credentialed scanning. Backport-aware version comparison (understands 1:8.9p1-3ubuntu0.6). Credentials stored AES-256-GCM encrypted, zeroized on drop, never logged.

Phase 4: Web/API DAST. Full OWASP Top 10 coverage. Intelligent crawler understands SPAs, REST APIs, and GraphQL endpoints. Context-aware injection selects payloads based on rendering context. Multi-technique confirmation reduces false positives.

Phase 5: Continuous Assessment. Scan orchestration engine with CISA KEV correlation, EPSS exploitation probability scoring, risk-based prioritization, and attack surface monitoring. Comparable to Tenable.io or Qualys VMDR, built into the same platform.

Code Security Scanner

Security doesn’t start at runtime. Sentrios scans Git repositories and local codepaths before vulnerabilities reach production:

• Secret detection: API keys, passwords, and tokens hardcoded in source
• SCA dependency analysis: package.json, requirements.txt, Cargo.toml, pom.xml
• Code pattern matching: SQL concatenation, eval(), unsafe deserialization, command injection sinks
• IaC scanning: Terraform misconfigurations, Dockerfile issues, Kubernetes manifests
• Languages: Python, JavaScript/TypeScript, Java, C#, Go, Rust, PHP, Ruby

Native Compliance, Not Bolt-On

NIS2, GDPR, and ISO 27001 are first-class features. Every vulnerability finding is automatically mapped to the articles it violates. Phase 2 findings alone cover NIS2 Art. 21(2)(d) for deprecated TLS, Art. 21(2)(e) for known CVEs and CISA KEV entries, and Art. 21(2)(j) for default credentials and anonymous access.

Danish Heritage, European Data Sovereignty

Built in Denmark. All processing within EU borders. The platform supports Danish-language reporting (da-DK) for organizations operating under Danish NIS2 transposition requirements.

Getting Started

A single docker compose up brings up the full stack: manager, agent, OpenSearch, and dashboard. Lightweight agents enroll via mutual TLS in under a minute. The 31-page dashboard surfaces alerts, compliance posture, vulnerability trends, and threat intelligence from day one.

We’re excited to share this with you. Follow the blog for compliance guides, detection engineering posts, and vulnerability scanner deep dives.