Web3 Integration Overview

Tamandua Sentinel combines self-hosted endpoint detection with privacy-preserving blockchain proofs on Solana. The current Web3 surface is intentionally narrow: proof metadata, public verification, and ecosystem primitives. It is not a telemetry store, not a guarantee that an endpoint is safe, and not yet a production mainnet bounty marketplace.

The core principle:

Private telemetry. Public proof.

Sensitive endpoint data stays under the operator's control. Solana stores only bounded hashes and metadata that provide tamper-evident proof signals without exposing raw telemetry.

Why On-Chain Proofs?

Traditional security tools create an accountability gap. When an incident occurs, proving what happened requires trusting the vendor or exposing raw logs. This is problematic for:

• Regulatory compliance: Auditors need tamper-evident proof of security posture
• Insurance claims: Insurers need verifiable evidence of detection and response
• Treasury operations: Multisig approvers need assurance that signer endpoints are monitored
• Incident disclosure: Organizations need to prove they detected and contained threats
• Bounty payments: Rule contributors need verifiable credit for detections

Solana provides:

• Immutability: Once recorded, attestations cannot be modified
• Transparency: Anyone can verify an attestation exists
• Timestamping: Cryptographic proof of when events occurred
• Settlement: future low-cost bounty and marketplace settlement after validation

What Goes On-Chain

Tamandua's privacy model is strict. Every field is evaluated before publication.

Allowed (Public Proof)

Forbidden (Never Published)

• Hostnames (victim-pc.local)
• Usernames (john.doe, admin)
• Internal IPs (10.x.x.x, 192.168.x.x, 172.16-31.x.x)
• Private domains (.local, .lan, .internal, .corp)
• File paths (C:\Users\victim\malware.exe)
• Process command lines (powershell -enc ...)
• Raw process trees
• Credentials
• Customer names
• Raw telemetry payloads

Attestation Types

Tamandua is designed around three proof families. Incident attestations are the near-term working path; health and remediation proofs are product roadmap items unless explicitly enabled and validated in your deployment.

Proof of Incident

Proves a security event was detected and recorded.

{
  "t": "tamandua_attestation",
  "v": 2,
  "ih": "abc123...",
  "s": 4,
  "m": "T1555.003",
  "rh": "def456...",
  "op": "org_pseudonym...",
  "ap": "agent_pseudonym...",
  "ts": 1715180400
}

Use cases:

• Document incident for auditors
• Trigger insurance claim workflow
• Support disclosure requirements
• Credit rule author for bounty

Proof of Health

Proves an endpoint was monitored and met security policy during a time window.

{
  "t": "tamandua_health",
  "v": 1,
  "ph": "posture_hash...",
  "st": "monitored",
  "ca": 0,
  "ha": 0,
  "wh": 24,
  "ts": 1715180400
}

Use cases:

• Treasury workflow gates (verify signer endpoint health before approval)
• Custody team compliance
• Validator operator attestation
• Insurance policy requirements

Proof of Remediation

Proves a response action was executed after detection.

{
  "t": "tamandua_remediation",
  "v": 1,
  "rh": "remediation_hash...",
  "at": "quarantine",
  "st": "success",
  "ih": "incident_reference...",
  "ts": 1715180400
}

Use cases:

• Prove containment to auditors
• Document response timeline
• Support insurance claims
• Compliance evidence

Web3 Use Cases

Treasury and Custody

A treasury workflow can require that every signer endpoint has a recent Proof of Health before approving high-value transfers:

[Signer Endpoint] --> [Tamandua Agent] --> [Health Attestation]
                                                    |
                                                    v
[Treasury Policy] <-- [Verify on Solana] <-- [Transaction Gated]

Incident Disclosure

When an infostealer compromise occurs, an organization can publish bounded evidence signals about detection and containment timelines without exposing customer telemetry:

1. Tamandua detects credential theft (T1555)
2. Proof of Incident published to Solana
3. Automatic quarantine triggered
4. Proof of Remediation published
5. Auditor verifies both attestations via Solscan

Bounty Payouts

The bounty model is roadmap/product-preview, not a live public payout offer. The intended flow is:

1. Contributor submits Sigma rule
2. Rule passes validation and benchmark testing
3. Rule detects real incident across organizations
4. Attestation links incident to rule hash
5. Bounty can be claimed and paid via Solana only after antifraud, review, and treasury controls are enabled

Insurance Integration

Cyber insurers can verify security posture without raw log access:

• Fleet health attestations can record monitored windows and posture metadata
• Incident attestations can record that configured detection evidence produced an alert
• Remediation attestations can record response-action claims and timestamps
• All verifiable via public blockchain queries

Attestation Modes

Self-hosted operators choose how attestations are published:

The planned relay model creates a positive-sum game:

• Operators get free on-chain proofs
• Treant pays minimal fees (~$10/month for 1000 operators)
• Network gains comprehensive threat intelligence
• Security oracle becomes stronger with more data

Current Status

Tamandua Sentinel's Web3 integration is in advanced-alpha development. Current capabilities:

Working:

• Privacy-preserving attestation generation
• Solana Memo Program integration for proof metadata
• Pseudonymization pipeline
• IOC sanitization
• Public proof pages for bounded metadata

Validation / product preview:

• Health and remediation proof flows
• Bounty contribution review
• Batch relay operations
• Verifier registry and authority management

Roadmap:

• Mainnet deployment
• Production bounty settlement
• On-chain reputation attestations
• Multisig policy integrations
• Marketplace settlement
• Staking/slashing, if it survives antifraud and governance review

Getting Started

• On-Chain Attestations - Creating and understanding attestations
• Proof Verification - Verifying attestations on-chain
• Bounty System - Contributing rules and earning rewards
• Solana Program - Technical integration details
• Self-Hosted Relay - Running your own attestation relay

Further Reading

• Tamandua Sentinel Whitepaper - Full architecture and vision
• Privacy Architecture - Detailed privacy guarantees
• MITRE ATT&CK Coverage - Attack technique mapping