Capabilities and Limitations
Tamandua Sentinel is advanced alpha software with real endpoint, GUI, server, and response paths. This page describes what operators can expect from the current public surface and where runtime validation is still required.
Windows and Linux are the current public endpoint scope. macOS worker support is Preview/Experimental and should be treated as a lab evaluation path until telemetry, permissions, packaging, and rollback are validated for the target environment.
Current Scope
| Area | Windows | Linux | Notes |
|---|---|---|---|
| Agent telemetry | Supported | Supported | Process, file, network, DNS, and endpoint events depend on enabled collectors and privileges. |
| Network connections | Supported | Supported | Connections are normalized into remote_ip, remote_port, protocol, pid, and process_name. |
| DNS correlation | Supported | Supported | Recent DNS answers are cached locally and used to map IPs back to candidate domains. |
| Encrypted traffic metadata | Partial | Partial | sni, tls_sni, tls_version, ja3, ja3s, certificate, and certificate_risk are emitted only when real OS or packet-level visibility provides them. |
| GUI Network Insight | Supported | Supported | The GUI accepts Windows/Linux aliases and shows absent fields as unknown, not as fabricated values. |
| IP/domain blocking | Supported | Supported | Requires administrator/root privileges and platform firewall/hosts support. |
| Network isolation/restore | Supported | Supported | Should be validated in a VM first; Linux isolation must preserve the server allowlist. |
| Server NDR | Supported | Supported | Network events are normalized for encrypted traffic, flow, protocol, and lateral movement analyzers. |
| Solana attestation | Optional | Optional | Solana receives bounded proof metadata, never raw endpoint telemetry. |
macOS preview builds are intentionally excluded from the supported matrix above. Do not infer production macOS support from cross-platform UI fields or API schemas.
Roadmap-Only Areas
These areas may appear in planning docs, prototypes, or navigation experiments, but should not be represented as current production capabilities:
- CSPM and broad cloud posture management
- iOS/Android mobile endpoint agents
- Policy Gate for multisig/custody approval enforcement
- anti-DDoS or carrier-grade traffic scrubbing
- public marketplace for rules, configs, hardening packs, and playbooks
- on-chain reputation, staking, slashing, or DAO-style governance
- advanced NDR/DPI beyond normalized endpoint network telemetry and server-side correlation
Track these in Current Scope and Claim Boundary.
Network Insight Contract
Network events use these canonical fields where available:
remote_ip,remote_port,protocolpid,process_namedomain,domain_candidatesis_encryptedsni,tls_sni,tls_versionja3,ja3scertificate,certificate_riskenrichment
DNS events expose:
queryordomainanswersresolved_ipspid,process_namewhen available
The no-mock rule is strict: if a sensor cannot observe TLS, JA3, certificate, or domain context, Tamandua leaves the field absent instead of inventing a value.
Live Response Actions
The current response contract includes:
block_ipunblock_ipblock_domainunblock_domainlist_blocked_ipslist_blocked_domainsisolate_networkrestore_network
These actions are local endpoint changes. They can affect firewall rules, host resolution, or network reachability. Validate them on controlled Windows and Linux hosts before broad rollout.
Production Readiness Gates
Before production claims, validate:
- Server compile and tests in an environment with Elixir/Mix.
- Database migrations for NDR persistence.
- Windows response actions on a Windows VM.
- Linux response actions on a Linux VM.
- Packet-level TLS/JA3/certificate visibility under the intended sensor configuration.
- Recovery paths for failed block, unblock, isolate, and restore actions.
- Attestation mode with tenant-approved Solana network and key management.
What Solana Does Not Store
Solana is an optional proof rail. It does not store raw endpoint telemetry, hostnames, usernames, internal IP addresses, command lines, local file paths, credentials, or customer identity. Tamandua uses bounded proof metadata such as hashes, timestamps, severity, rule context, and signatures.