Introduction

System Description

AnyOne EDR is an endpoint detection and response platform by MarkAny GaneshaIT, deployed as two halves: endpoint agents on Windows hosts and a backend server in the cloud. Each agent collects kernel-level telemetry, normalizes it to OCSF, and streams it up to the backend over mTLS gRPC. The backend ingests and stores that telemetry, detects malicious patterns, and drives remediation, whether operator-dispatched from the SOC dashboard or automated. Response actions travel back down to the agent as cryptographically signed commands.

This is the whole-system technical reference: the endpoint agent and every backend service in scope. For installing, configuring, and operating just the agent, see the Installation Guide.

Document Purpose

This reference explains the architecture and internals of the AnyOne EDR system: what each component is, how it is built, and how the components act together. It is written for engineers building, extending, or debugging the platform, not for operators installing the agent.

It is organized two ways:

• Structure: what each part is. One page per in-scope repository, covering its boundary, responsibilities, and internal components. Diagrams are component views (C4-ish). Start at System Overview.
• Behavior: how the parts act together. One page per cross-service flow. Diagrams are sequence views. Start at Telemetry Egress.

Document Scope

In scope are six repositories, one structure page each: AnyOne-Endpoint, AnyOne-Kernel, AnyGateway, AnyOne-StaticAPI, AnyOne-SOC-Backend, AnyProto.

Out of scope are deployment infrastructure (AnyOne-Infra) and upstream detection and correlation (ocsf-events to alerts). The SOC backend consumes detection results, not raw telemetry.

Trust-bundle minting (offline anchor key) and the IOC filter build are standalone offline ops steps, not online services. The backend and agent only consume their outputs.