DTM™

DTM™ Sentinel Lab — System Architecture

Interoperability & Data Flow Overview

v1.1 • Last updated 10/25/2026

Legend

  • Ingest / Sources
  • Core Services
  • Experience / Output
  • Cross‑cutting Concerns

Common Event Schema (v1)

{
  id, timestamp, source, channel, actor, actor_type,
  geo: { country, region, lat, lon },
  topic_tags: ["cti", "geopolitics"],
  content: { title, summary, url },
  indicators: { ioc: [], iia: [] },
  scores: { credibility, relevance, severity, dtm },
  links: { parent_id, related_ids: [] }
}

Primary Integrations

  • GDELT / Event Registry / News API
  • AlienVault OTX / Abuse.ch / MISP
  • Reddit API / X API / Telegram (bots)
  • Ahmia (Tor search) / OnionScan
  • GeoNames / OSM / Mapbox
Ingest
OSINT Analysis Workbench
Student/Analyst tools: scraping, NLP, entity extraction
Ingest
Dark Web Intelligence
Tor discovery, chatter triage, intent classification
Ingest
Real‑Time Threat Feeds
OTX, Abuse.ch, MISP, CERTs
Ingest
Social / Open Channels
Reddit, X, Telegram, Discord
Core
Integration API Gateway
REST/Webhooks • AuthN/Z • Rate‑limit
Core
Event Stream / Message Bus
Kafka/RabbitMQ • Backpressure • Replay
Core
Normalization & Enrichment
Schema v1 • NER • Geo • IOC/IIA enrichment
Core
Correlation Engine
DTM scoring • Source weighting • Dedup
Experience
Sentinel Hub (Command)
Single pane • Cross‑feed correlation • Alert routing
Experience
Global Alert Monitor
Filters • Escalation • Geo overlays
Experience
Case & Scenario Engine
Turn alerts into labs • Rubrics • Checklists
Experience
Reporting & Templates
Threat briefs • Intel summaries • DOCX/PDF
Cross‑cutting
Data Lake & Knowledge Graph
Cold storage • Versioning • Graph relations
Cross‑cutting
Identity & Access
SSO • Roles • Scopes for students/instructors
Cross‑cutting
Audit, Telemetry & QA
Logs • Metrics • Model eval • Drift checks

Implementation Roadmap

  1. Create the Schema v1 JSON contract & publish as OpenAPI (Gateway).
  2. Instrument OSINT → Gateway → Bus path with mock producers (GDELT/OTX).
  3. Build Normalization & Enrichment microservice (NER, Geo, IOC).
  4. Implement DTM Correlation (source weighting + confidence).
  5. Wire to Sentinel Hub and enable alert→scenario handoff.
  6. Auto‑populate Report Templates from correlated entities.

API Contract — OpenAPI 3.1 (Schema v1)

Core endpoints for Events, Correlations, Alerts, and Reports. Copy/paste YAML into your API gateway (e.g., Kong, Tyk, API Gateway) to scaffold.

openapi: 3.1.0
info:
  title: DTMx Sentinel Lab API
  version: 0.1.0
# ... (rest of OpenAPI spec)
paths:
  /v1/events:
    post:
      summary: Ingest a single Event (Schema v1)
      # ...

Mock Producers — End-to-End Demo (GDELT → Gateway → Bus)

Python (requests + JWT)

import os, json, time, uuid, requests
# ... (Python code)

Node (fetch)

import fetch from 'node-fetch';
# ... (Node.js code)

DTM Correlation — Minimal Scoring Spec

# Inputs: normalized events E within window W ...

Report Templates — Auto-Pop Mapping

Normalization Microservice — Pseudo-Spec

POST /normalize { event } ...