How mohamed2007sarhan/kaevex works
Kaevex is a Windows endpoint-defense and SOC platform with native, web, and Android operator surfaces. The main workflow is operators querying and acting through a client, the API or native controls dispatching security work to endpoint engines, and findings or actions returning to dashboards and optional cloud services. The README documents capabilities not fully visible in the sampled excerpts; those are represented as subsystems without inferring unshown internal call chains.
Main entry points: kaevex-engine.c REST API engine · net_engine.h Network defense · soc_engine.h SOC cluster mesh · kaevex-gui.c Native controls
Components 23
Operator surfaces
- Native controls
src/gui/kaevex-gui.c - Web SOC dashboard
dashboard/src/App.tsx - Android security app
Application/app/src/main/java/com/kaevex/fireware/ui/navigation/AppNavigation.kt - Mobile security views
Application/app/src/main/java/com/kaevex/fireware/ui/screens/dashboard/DashboardScreen.kt - SOC dashboards
dashboard/src/pages/Dashboard.tsx
Service and data access
- REST API engine
src/kaevex-engine.c - Mobile and cluster API
src/engines/mobile_api_engine.h - Dashboard API client
dashboard/src/api/client.ts - Android API service
Application/app/src/main/java/com/kaevex/fireware/data/api/KaevexApiService.kt - Cloud synchronization
src/engines/supabase_engine.h
Endpoint defense
- Network defense
src/engines/net_engine.h - Adaptive firewall
src/engines/fw_engine.h - RansomShield recovery
src/engines/ransom_engine.h - SmartSandbox isolation
src/engines/sbx_engine.h - CVE agent and updater
src/engines/upd_engine.h - Application discovery
src/engines/discovery_engine.h
SOC operations
- AI SOC analysis
src/engines/ai_together_engine.h - SOC cluster mesh
src/engines/soc_engine.h - Bootkit forensics
src/engines/boot_rootkit_engine.h
External integrations
- Windows endpoint APIs
- Cloud AI inference
- Supabase services
Other components
- Security operator
Connections 29
- Security operator → Native controls: operates
- Security operator → Web SOC dashboard: operates
- Security operator → Android security app: operates
- Web SOC dashboard → Dashboard API client: requests data
- Web SOC dashboard → SOC dashboards: selects views
- Dashboard API client → REST API engine: calls REST API
- Android security app → Android API service: requests data
- Android security app → Mobile security views: renders screens
- Android API service → Mobile and cluster API: calls REST API
- Native controls → Network defense: controls
- Native controls → Adaptive firewall: controls
- REST API engine → Network defense: serves security data
- REST API engine → Adaptive firewall: dispatches lockdown
- REST API engine → CVE agent and updater: dispatches remediation
- REST API engine → AI SOC analysis: dispatches chat
- REST API engine → SOC cluster mesh: dispatches cluster actions
- REST API engine → Bootkit forensics: serves audit data
- Mobile and cluster API → SOC cluster mesh: manages pairing
- Mobile and cluster API → Network defense: reads threat data
- Network defense → Windows endpoint APIs: inspects connections
- Adaptive firewall → Windows endpoint APIs: enforces rules
- RansomShield recovery → Windows endpoint APIs: monitors files
- RansomShield recovery → Windows endpoint APIs: uses recovery snapshots
- SmartSandbox isolation → Windows endpoint APIs: isolates binaries
- CVE agent and updater → Windows endpoint APIs: inventories and patches
- Application discovery → Windows endpoint APIs: discovers applications
- AI SOC analysis → Cloud AI inference: requests inference
- Cloud synchronization → Supabase services: syncs telemetry
- SOC cluster mesh → SOC cluster mesh: shares threat intelligence