4 min read Updated June 19, 2026

Capabilities and Limitations

Tamandua Sentinel is advanced alpha software with real endpoint, GUI, server, and response paths. This page describes what operators can expect from the current public surface and where runtime validation is still required.

Windows and Linux are the current public endpoint scope. macOS worker support is Preview/Experimental and should be treated as a lab evaluation path until telemetry, permissions, packaging, and rollback are validated for the target environment.

Current Scope

AreaWindowsLinuxNotes
Agent telemetrySupportedSupportedProcess, file, network, DNS, and endpoint events depend on enabled collectors and privileges.
Network connectionsSupportedSupportedConnections are normalized into remote_ip, remote_port, protocol, pid, and process_name.
DNS correlationSupportedSupportedRecent DNS answers are cached locally and used to map IPs back to candidate domains.
Encrypted traffic metadataPartialPartialsni, tls_sni, tls_version, ja3, ja3s, certificate, and certificate_risk are emitted only when real OS or packet-level visibility provides them.
GUI Network InsightSupportedSupportedThe GUI accepts Windows/Linux aliases and shows absent fields as unknown, not as fabricated values.
IP/domain blockingSupportedSupportedRequires administrator/root privileges and platform firewall/hosts support.
Network isolation/restoreSupportedSupportedShould be validated in a VM first; Linux isolation must preserve the server allowlist.
Server NDRSupportedSupportedNetwork events are normalized for encrypted traffic, flow, protocol, and lateral movement analyzers.
Solana attestationOptionalOptionalSolana receives bounded proof metadata, never raw endpoint telemetry.

macOS preview builds are intentionally excluded from the supported matrix above. Do not infer production macOS support from cross-platform UI fields or API schemas.

Roadmap-Only Areas

These areas may appear in planning docs, prototypes, or navigation experiments, but should not be represented as current production capabilities:

  • CSPM and broad cloud posture management
  • iOS/Android mobile endpoint agents
  • Policy Gate for multisig/custody approval enforcement
  • anti-DDoS or carrier-grade traffic scrubbing
  • public marketplace for rules, configs, hardening packs, and playbooks
  • on-chain reputation, staking, slashing, or DAO-style governance
  • advanced NDR/DPI beyond normalized endpoint network telemetry and server-side correlation

Track these in Current Scope and Claim Boundary.

Network Insight Contract

Network events use these canonical fields where available:

  • remote_ip, remote_port, protocol
  • pid, process_name
  • domain, domain_candidates
  • is_encrypted
  • sni, tls_sni, tls_version
  • ja3, ja3s
  • certificate, certificate_risk
  • enrichment

DNS events expose:

  • query or domain
  • answers
  • resolved_ips
  • pid, process_name when available

The no-mock rule is strict: if a sensor cannot observe TLS, JA3, certificate, or domain context, Tamandua leaves the field absent instead of inventing a value.

Live Response Actions

The current response contract includes:

  • block_ip
  • unblock_ip
  • block_domain
  • unblock_domain
  • list_blocked_ips
  • list_blocked_domains
  • isolate_network
  • restore_network

These actions are local endpoint changes. They can affect firewall rules, host resolution, or network reachability. Validate them on controlled Windows and Linux hosts before broad rollout.

Production Readiness Gates

Before production claims, validate:

  1. Server compile and tests in an environment with Elixir/Mix.
  2. Database migrations for NDR persistence.
  3. Windows response actions on a Windows VM.
  4. Linux response actions on a Linux VM.
  5. Packet-level TLS/JA3/certificate visibility under the intended sensor configuration.
  6. Recovery paths for failed block, unblock, isolate, and restore actions.
  7. Attestation mode with tenant-approved Solana network and key management.

What Solana Does Not Store

Solana is an optional proof rail. It does not store raw endpoint telemetry, hostnames, usernames, internal IP addresses, command lines, local file paths, credentials, or customer identity. Tamandua uses bounded proof metadata such as hashes, timestamps, severity, rule context, and signatures.