Exegol Sentinel
Enterprise-grade logging

A JSON including commands, metadata and output. Plus optional artifacts collected through a Trigger-Action system. SIEM-collecting-agent-friendly.

The logs

For each interactive command, logs are produced.

[Sep 10, 2026 - 20:16:37 (UTC)] exegol-sentinel /workspace # GetUserSPNs.py -outputfile Kerberoastables.txt -dc-ip "$DC_IP" "$DOMAIN"/"$USER":"$PASSWORD"

logs.jsonNDJSON

{
  "start_time": "2026-09-10T20:16:37.050Z",
  "end_time": "2026-09-10T20:16:37.388Z",
  "hostname": "exegol-sentinel",
  "container_name": "exegol-sentinel",
  "working_directory": "/workspace",
  "shell": "zsh",
  "user_command": "GetUserSPNs.py -outputfile Kerberoastables.txt -dc-ip \"$DC_IP\" \"$DOMAIN\"/\"$USER\":\"$PASSWORD\"",
  "resolved_command": "GetUserSPNs.py -outputfile Kerberoastables.txt -dc-ip \"10.10.10.42\" \"lab.local\"/\"auditor\":\"<REDACTED>\"",
  "envs_in_command": {
    "DC_IP": "10.10.10.42",
    "DOMAIN": "lab.local",
    "USER": "auditor",
    "PASSWORD": "<REDACTED>"
  },
  "exit_code": 0,
  "event_id": "25ca39b0e3274e30b5dbeb564a805969",
  "schema_version": 1,
  "output": "Impacket (Exegol fork) v0.14.0.dev0+20260120.113623.b52b6449 - Copyright Fortra, LLC and its affiliated companies \n\n[-] [Errno 113] No route to host\n",
  "output_truncated": false,
  "output_bytes": 475,
  "artifact_id": "2377ebb30e0f4dec90f9c462bd2a6330"
}

Triggers, Actions, Artifacts

Configure additional data that should be collected, and when it should be collected. Create Sentinel profiles and centralize them in your organization repo to make sure the team is in sync.

The following are demo examples made available in the first version of the Sentinel Core Library.

profiles/demo.ymlYAML

# Demo profile:
# 1) Dump Kerberos ticket
#    - TRIGGERS: Kerberos Pass-the-Ticket/Pass-the-Ccache on Impacket / evil-winrm-pydump the KRB5CCNAME cache
#    - ACTIONS: Dump the contents of the file pointed to by the KRB5CCNAME environment variable
# 2) Network capture
#    - TRIGGERS: Responder or bettercap is used
#    - ACTIONS: Network capture for the life of the process

profiles:
  demo:
    config: 
      log_rotation: 
        enabled: true
        compress: true
        max_size: 100MB
        max_files: 0
      env_redact:  # Redact sensitive environment variables (w/ optional pattern matching)
        - "AWS_SECRET_ACCESS_KEY"
        - "KRBTGT*"
        - "*TOKEN*"
    rules:
      - triggers:
          - kerberos_pass_the_ticket
        actions:
          - dump_kerberos
      - triggers:
          - responder_or_bettercap
        actions:
          - capture_net

On the Docker host

~/.exegol/sentinel/
└── exegol-sentinel_1725962513/
    ├── logs.json
    └── artifacts/
        └── a1b2c3d4/
            ├── env_vars.json
            ├── capture_any.pcap
            └── krb5cc_0

Connect to your SIEM

Can be ingested by collecting agents

Elastic
Splunk
QRadar
Datadog
Graylog
Wazuh

Made for organizations

Exegol Sentinel is available as a paid add-on to the Enterprise tier, the Exegol team can help prepare profiles, triggers, actions, and help set up the system.