Tamandua Agent Overview

The Tamandua EDR Agent is a lightweight endpoint agent written in Rust that provides telemetry collection, detection signals, and response capabilities. It runs as a system service and is designed for low overhead, with production behavior dependent on enabled collectors, privileges, and platform support.

What the Agent Does

The Tamandua Agent performs the following core functions:

Supported Platforms

The current public agent support matrix is Windows and Linux first. macOS is available only as a Preview/Experimental evaluation target.

Windows

Windows-specific features:

• ETW (Event Tracing for Windows) integration
• AMSI (Antimalware Scan Interface) monitoring
• Registry change tracking
• WMI event subscription monitoring
• CLR/.NET runtime monitoring
• Kernel minifilter driver support

Linux

Linux-specific features:

• eBPF-based telemetry collection (kernel 5.4+)
• auditd integration
• Container monitoring (Docker, containerd, Podman)
• SELinux/AppArmor compatibility

macOS

macOS preview scope:

• Endpoint Security Framework integration under evaluation
• TCC (Transparency, Consent, Control) monitoring under evaluation
• XPC service monitoring under evaluation
• System Extension packaging and approval flows under evaluation

Collection Capabilities

The agent includes multiple telemetry collectors that can be individually enabled or disabled based on your security requirements and performance constraints.

Core Collectors

Advanced Detection Collectors

Specialized Collectors

AI/ML Collectors

Resource Usage

The agent is designed for minimal system impact with three performance profiles:

Performance Profiles

Resource Governor

The agent includes an adaptive resource governor that:

• Monitors CPU and memory usage in real-time
• Automatically throttles collectors when resource thresholds are exceeded
• Provides graduated pressure levels (normal, elevated, critical, emergency)
• Ensures the agent never degrades system performance beyond configured limits

Typical Resource Usage (Balanced Profile)

Architecture

+------------------+     +-------------------+     +------------------+
|   Collectors     | --> |  Analysis Pipeline| --> |    Transport     |
|  (Process, File, |     |  (YARA, ML, IOC)  |     |   (WebSocket)    |
|   Network, etc.) |     |                   |     |                  |
+------------------+     +-------------------+     +------------------+
         |                        |                        |
         v                        v                        v
+------------------+     +-------------------+     +------------------+
| Resource Governor|     |  Response Engine  |     |  Backend Server  |
| (CPU/Mem Limits) |     | (Kill, Quarantine)|     |  (Phoenix/Elixir)|
+------------------+     +-------------------+     +------------------+

Security Features

Agent Self-Protection

• Anti-tamper monitoring: Detects and alerts on supported attempts to terminate or modify the agent
• Watchdog process: Automatic restart on unexpected termination
• Protected service: Runs as a protected Windows service (PPL where available)
• Secure uninstall: Requires installation token to uninstall

Secure Communication

• TLS 1.3: All communication encrypted with modern TLS
• Certificate pinning: Optional certificate pinning for additional security
• mTLS: Mutual TLS authentication in production deployments
• Automatic reconnection: Resilient connection handling with exponential backoff

Update Security

• Signed updates: All updates verified with Ed25519 signatures
• Integrity checking: SHA-256 verification before installation
• Atomic updates: Rollback capability on update failure
• Model updates: Separate signed updates for ML models and detection rules

Next Steps

• Install on Windows
• Install on Linux
• Evaluate macOS Preview
• Configure the Agent
• Enroll Agents