Endpoint Agent

The endpoint agent runs on Windows systems and is responsible for collecting telemetry, applying local logic, and sending investigation-ready alerts to the backend.

Responsibilities

• Read Sysmon events from the local endpoint
• Normalize event fields into a stable schema
• Evaluate JSON detection rules
• Build alert context such as process lineage and timestamps
• Queue and upload alerts over HTTPS
• Report agent health and sync status

Telemetry sources

The agent is designed around Sysmon-driven visibility, including:

• Process creation
• Network connections
• Image loads
• File create and delete activity
• Registry changes
• DNS queries
• Process access activity
• Process tampering signals

Agent architecture

The agent is organized around:

• Separate collectors for file, process, and network telemetry
• A detection engine that applies JSON rules and MITRE context
• Enrichment services for process trees, hashes, signatures, and metadata

Agent inventory view

These screens show the operator-facing agent workflows:

• Service status and heartbeat health
• Local rule counts and upload settings
• Triggered events before or after delivery to the backend
• Quick operational actions such as upload, reload, and log review

Sysmon event coverage

Event ID	Event type	Purpose
1	Process Creation	Logs new process execution with command-line arguments
3	Network Connection	Captures outbound TCP/UDP connections initiated by processes
7	Image Load	Records DLL and module loading events
8	CreateRemoteThread	Captures remote thread creation often associated with process injection
10	Process Access	Logs attempts by one process to access another
11	File Create	Logs creation of new files on the system
12	Registry Event Create/Delete	Captures creation or deletion of registry objects
13	Registry Value Set	Logs modifications to registry values
14	Registry Rename	Records renaming of registry keys or values
15	FileCreateStreamHash	Records alternate data stream creation and file hash information
19	WmiEventFilter	Captures WMI event filter activity used in persistence
20	WmiEventConsumer	Logs WMI event consumer activity used in persistence mechanisms
22	DNS Query	Captures DNS lookups performed by processes
23	File Delete Archived	Logs deleted files and stores metadata before removal
25	Process Tampering	Records attempts to modify a running process image or memory
26	FileDeleteDetected	Detects file deletion events useful for cleanup or defense evasion tracking

Agent pipeline

1. Read the event from Sysmon.
2. Transform it into normalized fields.
3. Evaluate matching rules.
4. Enrich hits with local evidence.
5. Correlate related records when local linkage is available.
6. Place the alert in an upload queue.
7. Send the payload to the cloud backend.

Operational design

• Runs continuously in the background
• Uses bounded local storage for queued data
• Retries failed uploads with backoff
• Avoids blocking endpoint activity during backend outages
• Separates collection, rule evaluation, enrichment, and upload into clear components