Sentinel IOC

A C++ project for analyzing Indicators of Compromise (IOCs) using Object-Oriented Programming principles.

Description

Sentinel IOC simulates an IOC analyzer (malicious IPs, URLs, and hashes), enabling users to register, view, update, and delete this information. It’s a practical introduction to Object-Oriented Programming (OOP) in C++.

Technologies Used

Language: C++
OOP Concepts: Inheritance, Polymorphism, Encapsulation & Abstraction
File Handling: CSV (simulating database)
Tools: Git & GitHub
Documentation: GitHub Pages
Other: Pointers and References

Features

Register IOCs (IP, URL, Hash)
List and search IOCs
Update and delete IOCs
Simulated threat analysis
Command-line interface
Graphical User Interface (optional, under development)

Project Structure

📁 sentinel-ioc/
 ┣ 📁 googletest                   >> Unit tests
 ┣ 📁 src/
 ┃ ┣ 📁 CLI                 
 ┃ ┃ ┣ 📄 cli.hpp                  >> CLI interface class
 ┃ ┃ ┗ 📄 cli.cpp
 ┃ ┣ 📁 data/
 ┃ ┃ ┗ 📄 iocs.csv                 >> Simulated database (CSV format)
 ┃ ┣ 📁 fileManager                 
 ┃ ┃ ┣ 📄 fileManager.hpp          >> File read/write manager
 ┃ ┃ ┗ 📄 fileManager.cpp
 ┃ ┣ 📁 indicator                 
 ┃ ┃ ┣ 📄 indicator.hpp            >> Abstract base class for IOCs
 ┃ ┃ ┗ 📄 indicator.cpp              
 ┃ ┣ 📁 indicatorManager
 ┃ ┃ ┣ 📄 indicatorManager.hpp     >> Manages IOC CRUD operations
 ┃ ┃ ┗ 📄 indicatorManager.cpp
 ┃ ┣ 📁 maliciousHash
 ┃ ┃ ┣ 📄 maliciousHash.hpp        >> Derived class for malicious hash
 ┃ ┃ ┗ 📄 maliciousHash.cpp
 ┃ ┣ 📁 maliciousIP
 ┃ ┃ ┣ 📄 maliciousIP.hpp          >> Derived class for malicious IP
 ┃ ┃ ┗ 📄 maliciousIP.cpp
 ┃ ┣ 📁 maliciousURL
 ┃ ┃ ┣ 📄 maliciousURL.hpp         >> Derived class for malicious URL
 ┃ ┃ ┗ 📄 maliciousURL.cpp
 ┃ ┣ 📁 utils
 ┃ ┃ ┣ 📄 utils.hpp                >> Utility functions (e.g., menu, timestamps)
 ┃ ┃ ┗ 📄 utils.cpp
 ┃ ┣ 📄 sentinel.exe               >> Main executable
 ┃ ┣ 📄 sentinel_tests.exe         >> Unit tests executable   
 ┃ ┗ 📄 main.cpp                   >> Application entry point
 ┣ 📁 public/
 ┃ ┣ 📁 assets                     >> Project images
 ┃ ┣ 📄 sentinel-ioc.puml          >> UML diagram 
 ┃ ┗ 📄 report.md                  >> Project report
 ┃ ┗ 📄 report.pdf                 >> Project report
 ┗ 📄 README_EN.md

OOP Concepts Demonstrated

Classes & Objects: Used to define and instantiate IOCs and their manager.
Inheritance: MaliciousIP, MaliciousURL, and MaliciousHash inherit from the base class Indicator.
Polymorphism: A single Indicator* pointer can refer to any derived IOC type.
Encapsulation: Controlled access via private, protected, and public members.
Abstraction: The Indicator class acts as an abstract interface for different types of indicators. The CLI only interacts with the IndicatorManager’s public interface, without knowing the internal details of storing, searching or generating IDs.

How to Run on CLI

Clone the Repository

git clone https://github.com/bomday/sentinel-ioc.git

Requirements

g++ version 7.0 or later
Compile and run from the /src directory

Compile the Program

g++ -g -std=c++17 -o sentinel.exe main.cpp cli/cli.cpp utils/utils.cpp indicator/indicator.cpp maliciousIP/maliciousIP.cpp maliciousURL/maliciousURL.cpp maliciousHash/maliciousHash.cpp indicatorManager/indicatorManager.cpp fileManager/fileManager.cpp -I. -Icli -Iutils -Iindicator -ImaliciousIP -ImaliciousURL -ImaliciousHash -IindicatorManager -IfileManager

Run the Program

./sentinel.exe

Running Unit Tests

See the Test README

Running the Graphical User Interface (GUI)

See the GUI README

Video Demo

🔗 Understand our structure and watch our Demo: YouTube

Interface finalized after first delivery

Images

Sentinel IOC Interface

Project Report

See the Report

Team

Name	Course
Beatriz Helena	Information Systems
Dayane Lima	Information Systems
Maria Antônia	Information Systems
Rafael Teles	Information Systems
Williams Andrade	Information Systems