Centinela: security automation for ISP networks

Python project to detect and block network threats on MikroTik routers. Combines API access, threat intelligence, and analysis with a local LLM in Ollama.

Problem and scope

Automatic detection and blocking of network threats for ISPs. The project brings together network signals and threat context to support technical operations.

Project components

MikroTik API

Access to router connections for threat monitoring.

Threat intelligence

AbuseIPDB and GeoIP provide context for analysis.

Ollama / local LLM

Enriches threat analysis and supports signal classification.

Python

Integrates monitoring, analysis, and automatic blocking actions.

Available evidence

Project screenshot and component description. The repository is private.

Centinela project interface for MikroTik threat monitoring

Operating principle

The LLM is a supporting layer, not the sole authority for blocking. The working approach includes protecting operational data, reviewing changes, and local validation. Detection and false-positive rates are not published without documented measurements.

Discuss an infrastructure role