Proactive Sentinel

Financial-services providers need security monitoring that catches multi-stage attacks and business-signal anomalies without a heavyweight enterprise SIEM.

Events route through a DetectionEngine (Redis dedup + MITRE correlation). After an alert is persisted, an Action Dispatcher fires by severity: critical alerts block the attacker IP in Redis and write an audit entry; lower severities degrade gracefully. Observability is OpenTelemetry plus structured JSON logs.

1. 01

   SHA-256 fingerprint deduplication in Redis suppresses duplicate events at ingest, before they can create alert noise.

2. 02

   MITRE ATT&CK chain correlation across events — recon followed by lateral movement followed by exfiltration escalates to a critical chain alert, which single-event rules would miss.

3. 03

   Dispatcher failures are non-fatal: a Redis outage degrades response, never alert persistence.

4. 04

   POPIA compliance at the data layer: SA and Zimbabwean IDs masked before storage, PII columns encrypted with AES-256-GCM.