A Security Engineer built Sentinel-IP, a Python tool that automates threat intelligence lookups for suspicious IPs. The project tackles analyst fatigue by cutting a 30-minute manual task to 30 seconds. It uses Docker for easy deployment and queries AbuseIPDB and AlienVault OTX APIs to enrich data.

The developer originally planned to use VirusTotal but pivoted due to its restrictive free tier. Switching to AlienVault OTX removed a major bottleneck, allowing the tool to scan dozens of IPs in seconds. This highlights a key lesson in security engineering: timely data is critical for effective threat response.

Sentinel-IP works by reading IPs from a text file and generating a CSV report. Real-world use cases include filtering firewall logs for high-confidence threats and analyzing phishing email headers. The tool demonstrates practical API integration, containerization, and data correlation for modern SOC workflows.