Terminal Defence: Distributed Endpoint Security

Traditional enterprise security frameworks such as Active Directory rely on manual administration, static policies, and lack built‑in intelligence to counter modern cyber threats. This paper presents SentinelAI, an autonomous endpoint security system that replaces Active Directory with a distributed network of AI agents. The system comprises a central server, lightweight endpoint bots, and a web dashboard. It performs real‑time monitoring of processes, network connections, logon events, and file system changes. Policies are defined as dynamic JSON rules targeting users, groups, machines, or organizational units and are instantly pushed to endpoints via WebSocket. An integrated threat‑scoring heuristic triggers automatic lockdown, isolating compromised endpoints, capturing comprehensive forensic snapshots, and allowing controlled unlock by administrators. The system supports MFA, LDAP integration, and role‑based access control, providing a scalable and explainable alternative for modern enterprise security. Experimental results demonstrate effective enforcement, low resource consumption, and rapid incident response, positioning SentinelAI as a practical research contribution in the domain of autonomous endpoint security.