rithvik1124/edrlite-linuxtelemetryagent

Purpose and topology

This repository is a Linux security telemetry and detection prototype. A root Rust/BPF component captures kernel-level events, while a separate Rust server receives, persists, and evaluates telemetry against Sigma/YARA-oriented detection rules.

Runtime entry points

• Endpoint/collector executable: src/main.rs

• Server executable: server/src/main.rs

• eBPF program source and generated bindings/object: bpf/trial.bpf.c, src/trial.skel.rs, trial.bpf.o

• Build integration for BPF artifacts: build.rs, build.sh

The project is Rust/Cargo-based at both the root and server/, with Linux/eBPF kernel dependencies implied by vmlinux.h and the BPF sources.

Endpoint telemetry collection

The collector couples userspace Rust with an eBPF probe:

• Kernel-side instrumentation is defined in bpf/trial.bpf.c, with a secondary Rust BPF-related source at bpf/some.rs.

• vmlinux.h supplies kernel type definitions for BPF compilation.

• src/trial.skel.rs is the generated skeleton/binding boundary used by userspace.

• Telemetry handling is organized under src/telemetry/new.rs and likely invoked from src/main.rs.

Control flow is expected to be: load BPF object → attach probes → read emitted events in userspace → serialize/send or locally evaluate events.

Detection layer

Detection code exists independently in both collector and server:

• Collector detection module: src/detect/mod.rs, src/detect/edr_detect_rules.rs

• Server detection module: server/src/detect/mod.rs, server/src/detect/edr_detect_rules.rs

This duplication suggests detection may be usable at both edge and central ingestion boundaries. The rule evaluator is a key abstraction boundary: telemetry event schemas enter it, and alerts/result reports leave it.

Rule content and rule distribution

Rules are file-based and split by format:

• Sigma event rules: rules/sigma/, including rules/sigma/proc_creation_lnx_base64_execution.yml

• YARA content rules: rules/yara/, including rules/yara/Maldoc_VBA_macro_code.yar

• The server carries its own rule copy under server/rules/sigma/ and server/rules/yara/.

Sigma rules focus on Linux process, file, and log activity. YARA rules target suspicious document/malware content. Duplicated rule trees mean collector and server rule deployment can diverge unless explicitly synchronized.

Server ingestion and persistence

The server’s telemetry and database boundary is concentrated in:

• server/src/telemetry.rs

• server/src/db/events_in.rs

• server/src/db/result_reports.rs

• server/src/db/initialize_db.rs

Incoming events are handled by the telemetry layer, stored as input events, evaluated by detection, and persisted/emitted as result reports. server/events_in.redb indicates Redb is the embedded persistence backend; no external database service is evidenced.

Key operational boundaries

1. Kernel ↔ collector userspace: eBPF event transport through bpf/trial.bpf.c and src/trial.skel.rs.

2. Collector ↔ server: telemetry transport, implemented at the application level but with protocol details not visible in the tree.

3. Raw event ↔ detection: edr_detect_rules.rs modules translate event data into rule matches.

4. Detection ↔ persistence/reporting: server DB modules retain raw inputs and detection outputs.

5. Rule files ↔ runtime evaluator: Sigma/YARA directories are externally editable detection content loaded by application code.