Technical Architecture

Sentinel Drone (Agent)

The agent is built with Python and Flask, utilizing SQLAlchemy for state management. It runs as a systemd service (`sentinel.service`) and manages background tasks via APScheduler.

MySQLAnalyzer

A custom module that parses the MySQL slow query log, normalizes queries, and executes `EXPLAIN` plans to identify missing indexes, filesort issues, and full table scans.

Index Suggestion Logic

Sentinel uses a weighted scoring system to prioritize index candidates:

score = (query_frequency * avg_latency) / rows_examined
if rows_examined > 10000 and 'Using filesort' in explain_plan:
    suggest_index(columns, priority='HIGH')

Security State Sync

The Security Autopilot periodically scans for active listening ports and ensures corresponding Fail2Ban jails are active:

active_services = get_listening_ports()
for service in active_services:
    if not f2b_manager.has_jail(service):
        f2b_manager.create_jail(service)
        f2b_manager.reload()