Introduction to Tamandua Sentinel

Tamandua Sentinel is a self-hosted EDR/XDR for Web3 operators and security teams. It protects Windows and Linux endpoints used by exchanges, custody teams, market makers, validators, treasury teams, and protocol operators from endpoint compromise.

Core Principle: private endpoint telemetry, inspectable evidence, optional public proof.

What is Tamandua Sentinel?

Tamandua Sentinel is an endpoint detection and response platform designed for operators who need local control over telemetry and response. Unlike products that require sending sensitive workstation data to a vendor-controlled cloud, Tamandua keeps endpoint data on infrastructure you control while optionally publishing cryptographic proof metadata on Solana.

Agent Telemetry  -->  Server Detection/NDR  -->  Alert Evidence  -->  Live Response  -->  Optional Attestation

The Problem Tamandua Solves

Many Web3 incidents start before funds move on-chain. Common attack paths include:

Browser credential theft
Session cookie exfiltration
Wallet artifact and seed phrase hunting
API key exposure
Malicious remote access
Developer workstation compromise
Compromised operator laptops approving high-value transactions

A transaction can be perfectly valid on-chain while the signer endpoint is already compromised. Tamandua targets this gap between traditional endpoint security and Web3 operational risk.

Key Features

ML-Assisted Scoring

Tamandua includes a Malware-SMELL-inspired machine learning path for malware scoring. The current model artifacts are smoke-scale and validation-ready only; production ML claims require the guarded ML-1..ML-6 benchmark chain. This research-backed approach is designed to provide:

Similarity-space malware scoring without training on specific samples
Behavioral analysis of process trees and attack graphs
Complementary ML signals alongside YARA/Sigma rules

Network Insight

Tamandua normalizes endpoint network telemetry into one Windows/Linux contract:

remote IP, remote port, protocol, PID, and process name
DNS query, answers, resolved IPs, and domain candidates
SNI/TLS, JA3/JA3S, certificate, and certificate-risk fields when real packet or OS sensor visibility provides them
server-side network/XDR correlation, flow/protocol/lateral movement analysis, and encrypted traffic alerts where real telemetry exists

Privacy-Safe On-Chain Proofs

Sensitive endpoint telemetry never leaves your control. Solana stores only:

Allowed on Solana	Never on Solana
Incident hash	Hostname
Manifest hash	Username
Severity level	Internal IP
MITRE technique	Local file path
IOC count (not values)	Process command line
Safe IOC types	Customer name
Pseudonymous identifiers	Raw telemetry
Transaction signature	Credentials

Three Proof Types

Proof of Incident

Cryptographic proof that a high-severity security event was detected and recorded.

Proof of Health

Roadmap/product-preview attestation that an endpoint was monitored and met a defined posture policy during a time window.

Proof of Remediation

Roadmap/product-preview proof that a response action or playbook completed after detection.

Deterministic Detection Rules

YARA Rules: built-in and custom rules for known malware signatures
Sigma Rules: parser/runtime support for common behavioral rules and modifiers
IOC Matching: Hash, domain, IP, and URL indicators

Automated Response

When threats are detected, Tamandua can:

Terminate malicious processes
Quarantine suspicious files
Isolate compromised hosts from the network
Block or unblock IP addresses
Block or unblock domains
Execute automated playbooks
Generate remediation proofs

Architecture Overview

+------------------------------------------------------------------+
|                      TAMANDUA SENTINEL                            |
+------------------------------------------------------------------+
|                                                                    |
|  ENDPOINTS              SERVER                  INTELLIGENCE       |
|  (Rust Agent)    -->    (Elixir/Phoenix)   -->  (Python ML/NDR)   |
|       |                       |                       |           |
|       v                       v                       v           |
|  KERNEL/eBPF         DETECTION ENGINE           THREAT INTEL      |
|  ETW/WFP/Linux       (YARA/Sigma/ML/NDR)       (External APIs)    |
|                              |                                     |
|                              v                                     |
|                      SOLANA PROOF LAYER                           |
|                    (Attestations Only)                            |
|                                                                    |
+------------------------------------------------------------------+
|                 DASHBOARD (Phoenix LiveView)                      |
+------------------------------------------------------------------+

Component Summary

Component	Technology	Purpose
Agent	Rust	Endpoint telemetry collection and response execution
Server	Elixir/Phoenix	Correlation, detection, alert management
ML Service	Python/PyTorch	Malware-SMELL-inspired scoring; production model validation pending
Driver / OS sensors	C/eBPF/ETW/WFP	Kernel and OS-level visibility where available
GUI / Dashboard	Tauri, React, LiveView	Real-time monitoring, Network Insight, and investigation
Solana Layer	Memo/Anchor	Optional privacy-safe attestation publishing

Data Flow

Collection: Agent collects process, file, DNS, network, and registry events
Transport: WebSocket connection with JWT authentication to Phoenix backend
Ingestion: Broadway pipeline processes telemetry at scale
Detection: YARA, Sigma, and ML analysis runs on incoming events
Alert: High-confidence detections generate alerts with MITRE, process, and network context
Attestation: When enabled, the privacy pipeline redacts sensitive data and publishes bounded proof metadata to Solana
Response: Automated or analyst-triggered containment actions
Verification: Anyone can verify attestations on Solscan without PII exposure

Deployment Options

Self-Hosted (Community)

Full control over your security infrastructure:

No vendor account required
No artificial endpoint limits
All telemetry stays on your servers
Optional Solana attestation via relay (free) or self-pay

Tamandua Cloud (Roadmap)

Managed infrastructure for teams that want less operational burden:

Managed agents and server
Premium threat intelligence
Extended retention
Enterprise SSO/RBAC
MSSP workspace support

Who Should Use Tamandua?

Tamandua is designed for:

Exchange operators protecting trading infrastructure
Custody teams securing signing workstations
Market makers defending automated trading systems
Validators protecting consensus infrastructure
Treasury teams securing approval workflows
Protocol operators monitoring privileged infrastructure

Current Maturity

Tamandua Sentinel should be considered advanced alpha until full runtime validation is complete in the target environment.

Validated capabilities:

Self-hostable EDR/XDR architecture
Web3 operator focus
Privacy-safe Solana attestations (devnet)
ML-assisted scoring path with smoke-scale artifacts and production validation pending
Automated and analyst-triggered response actions where platform support is validated
Windows/Linux Network Insight contract across agent, GUI, IPC, and server code paths

Requires production proof:

Mainnet Solana integration
Production mTLS deployment
Full marketplace operation
Enterprise multi-tenant isolation
Packet-level TLS/JA3/certificate collection under the intended sensor configuration
Response validation on controlled Windows and Linux hosts

Next Steps

Ready to get started? Continue with these guides:

Quick Start - Deploy your first agent in 5 minutes
System Requirements - Hardware and software prerequisites
Architecture Deep Dive - Detailed component and security documentation

Research Foundation

The ML layer is grounded in peer-reviewed research:

Malware-SMELL: A zero-shot learning strategy for detecting zero-day vulnerabilities Computers & Security 120 (2022), 102785

Tamandua adapts this approach into an operational EDR/XDR pipeline where ML scoring complements deterministic rules, behavioral telemetry, and response workflows.

Getting Help

Documentation: Browse the full documentation in the sidebar
GitHub Issues: Report bugs and request features
Security Reports: Contact security@tamandua.io for vulnerabilities

Last updated: May 2026