SentinelMesh: Autonomous AI SOC on AMD GPU

SentinelMesh is an enterprise-grade, autonomous multi-agent AI Security Operations Center (SOC) purpose-built for on-premise execution on AMD Instinct GPUs using ROCm 6.2 and vLLM. Traditional SOCs struggle with catastrophic alert fatigue, high mean-time-to-respond (MTTR), and cloud API privacy risks. SentinelMesh solves this by deploying a collaborative team of specialized autonomous AI agents that detect, investigate, contain, and report cyber threats in seconds with 100% data sovereignty. Architecture & Multi-Agent Pipeline: 1. Triage Agent: Evaluates heterogeneous telemetry (Linux auth, Nginx, Windows Security Events) against in-memory sliding-window rules, filtering noise with high confidence. 2. Investigator Agent: Reconstructs causal kill-chain attack graphs, identifies affected assets, and maps adversary tactics to MITRE ATT&CK techniques via local vector RAG. 3. Threat Intel Agent: Assesses IOCs against local threat feeds with automated abuse scoring. 4. Responder Agent: Formulates surgical containment actions (IP firewall blocks, account lockouts) guarded by a Human-in-the-Loop approval gate with automated rollback commands. 5. Reporter Agent: Synthesizes bilingual executive briefings in technical English and native Urdu (Nastaliq RTL) with WeasyPrint PDF export. AMD ROCm Hardware Synergy: Accelerated by AMD Instinct MI250X (128GB HBM2e) with ROCm 6.2 and vLLM PagedAttention, SentinelMesh delivers 138.5 tokens/sec throughput, 42ms TTFT latency, and a 79.5% operational cost reduction compared to commercial cloud APIs. Telemetry never leaves the enterprise boundary.