The threat catalog, the pipeline, the integration.
Pick a sector, read the watchlist.
Every template was confirmed by an operator who watches this kind of site for a living. Codes are stable; the dashboard uses the same strings.
Armed robbery in progress
bank_branch.armed_robbery
ATM loitering pattern
bank_branch.atm_loitering
Vault perimeter breach (after-hours)
bank_branch.vault_breach
Tailgating into staff area
bank_branch.tailgating
Cash counter approach without queue
bank_branch.counter_jump
Skimmer-pattern device on ATM
bank_branch.atm_skimmer
Six things, done well.
i.
Framework
Behavioural pattern catalog
160 codified threats across 16 sub-sectors. Each carries named evidence signals, a criticality level, and a response policy. Templates versioned and seeded from a Python module — never drift between code and DB.
ii.
Edge
Self-contained platform
PyInstaller binary runs as a Windows service. RTSP capture, ONNX Runtime inference, local SQLite. Configured from the cloud — XVR credentials, camera labels, zones, HD/SD per channel.
iii.
Identity
Cryptographic device proof
Every box generates an Ed25519 keypair on first provision. The public half goes to the cloud; the private half never leaves disk. Every WebSocket HELLO is signed and verified.
iv.
Classifier
Multimodal second opinion
Claude vision rates every detection against the matched template. Bad calls die at the classifier; good calls arrive with a written ruling. OpenAI gpt-4o-mini available for dev tier.
v.
Routing
Criticality-driven escalation
Critical → WhatsApp + repeated phone calls until acknowledged. High → WhatsApp + a phone call. Medium → email. Low → logged on the dashboard. Recipients follow your on-call schedule; unacked alerts escalate.
vi.
Zones
Polygon zones with purpose
Polygon zones aren't just geometry — they carry purpose tags (entrance, till, vault, staff-only). The same person crossing 'entrance' vs 'vault' fires different criticality.
From frame to phone call, in seconds.
STEP 01
Detect
Edge YOLOv8 on every frame
2 FPS inference per camera. Person + weapon + POS classes. Zone-polygon filter cuts noise before alerts form.
STEP 02
Match
Against sector templates
Detection geometry + camera zone purpose + sub-sector mapped to the most-specific template in the catalog.
STEP 03
Classify
Claude vision audit
Snapshot + template description shipped to the multimodal LLM. False positives killed here. Real ones come back with a one-line ruling.
STEP 04
Route
By criticality
Critical → WhatsApp + repeated calls until acknowledged. High → WhatsApp + a phone call. Medium → email. Low → logged on the dashboard. Unacked alerts escalate.
STEP 05
Audit
Every incident retained
Snapshot, classifier ruling, recipient acknowledgements, response time — stored, exportable for compliance.
Works with the cameras you already own.
No rip-and-replace. Sentinel speaks RTSP to any Dahua, Hikvision, or generic ONVIF DVR. The edge box sits on your LAN, talks to your XVR, ships only metadata to the cloud.
EDGE BOX — DEPLOYED UNIT
~$200 mini-PC on the LAN beside your XVR. The MSI installs in ninety seconds; auto-update handles every release after.
ADDENDUM
Don't see your sector? We'll codify it with you.
The framework is built to grow. If you operate in a vertical we haven't modelled yet, we'll spend a week shadowing your operators and ship templates for it.