A dedicated in-house SOC is out of reach for most Kenyan businesses. HarLyn Sentinel is a managed cybersecurity and threat-monitoring platform we are building to close that gap: continuous detection, investigation, and response across a business's infrastructure, without the cost of a million-dollar security operations team.
This page documents the architecture as designed and currently being built, jointly with Harry Ndeke under HarLyn Digital Partners — it is not yet a live, client-onboarded service, and this page will be updated honestly as that changes.
Engagement context
| Product | HarLyn Sentinel — internal HarLyn Digital Partners platform, pre-launch |
|---|---|
| My role | Chief Security & Compliance Architect — Wazuh detection rules, threat modeling, blue-team SOC governance, ODPC/GDPR regulatory defense, red-team attack simulation |
| Delivery partner | Harry Ndeke — AI Security Analyst engine, multi-tenant Next.js portal, n8n automation workflows |
| Status | Architecture and monorepo scaffolding complete. First integration sprint (local Wazuh lab, test agent enrollment, red-team simulation, AI analyst connection, n8n webhook pipeline) not yet run as of this writing. |
How it's designed to work
Sentinel doesn't reinvent telemetry collection — Wazuh is the security telemetry engine underneath it, handling log analysis, file integrity monitoring, and vulnerability scanning across customer laptops, servers, and databases. What HarLyn is building on top is the part that actually makes that telemetry usable for a business without a security team:
- Wazuh telemetry engine — raw alerts from customer infrastructure over an encrypted channel.
- AI Security Analyst — converts raw, Level 7+ alerts into plain-English context, a 0–100 risk score, and attack-chain mapping, so a non-specialist can understand what actually happened.
- n8n automation & dispatch — routes enriched alerts to WhatsApp/Slack, triggers auto-containment where safe, and opens tickets.
- Two dashboards — a central SOC console for HarLyn's own incident triage, and a separate client-facing executive dashboard showing risk posture and a monthly PDF compliance report.
Architecture
Sentinel is a monorepo: a Next.js 15 multi-tenant portal (client dashboard and SOC command center behind MFA), an AI-analyst service that summarizes and correlates multi-stage attack chains, a library of importable n8n workflow templates for SOC response, the Wazuh manager/agent infrastructure itself (containerized for local testing, with one-click Windows and Linux agent install scripts), and a dedicated red-team/blue-team simulation lab for validating detection rules before they reach a customer.
Why this is presented as in-development, not delivered
What this demonstrates
Even at this stage, the design reflects the same discipline behind TrustCapsule and the Security Audits service: separating raw telemetry from human-usable signal, keeping human-in-the-loop review on anything consequential, and building the compliance/reporting layer in from the start rather than bolting it on after a client asks for it.
Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.
Discuss Managed Security Monitoring →Related: TrustCapsule: Zero-Trust Data Protection Engine · Munar Security Baseline & Handover · All proof & deliveries