Endpoint Agent

Repo: AnyOne-Endpoint (Rust workspace). The per-host agent that runs as the AnyOneAgent Windows service (anyone-agent.exe). It collects kernel and OS telemetry, runs the OCSF pipeline, orchestrates static analysis, executes remediation, and manages its own enrollment identity.

Workspace crates

The workspace has five members. Only the drivers and the service run on the endpoint long-term.

Note: package names for the client/notifier crates (anyedr-cli, anyedr-notifier) differ from their binary names.

Component view

ℹ️ Arrow colors:

• Blue : data plane (telemetry flow)
• Orange : control plane (commands, enrollment, and remediation actions).

Source tree

The service crate is a single binary. Its source is organized by subsystem.

service/src/
├── main.rs
├── service.rs
├── bootstrap.rs
├── config.rs
├── context.rs
├── event.rs
├── stats.rs
├── constants.rs
├── driver.rs
├── sources/
│   ├── etw/
│   ├── eventlog.rs
│   ├── kcallback/
│   ├── minifilter/
│   ├── lifecycle.rs
│   └── tamperwatch.rs
├── pipeline/
│   ├── normalizer.rs
│   ├── dedup.rs
│   ├── enricher.rs
│   ├── mapper.rs
│   └── batcher.rs
├── channel/
│   ├── remotectl.rs
│   ├── telemetry.rs
│   ├── static_analysis.rs
│   ├── localctl.rs
│   ├── notification.rs
│   ├── ndjson.rs
│   └── handlers/
├── static_api/
│   ├── filter.rs
│   └── worker.rs
├── commands/
│   ├── dispatcher.rs
│   ├── verifier.rs
│   ├── registry.rs
│   ├── trust_bundle.rs
│   ├── kill_process.rs
│   ├── file_quarantine.rs
│   ├── isolate_host.rs
│   ├── update.rs
│   ├── update_package.rs
│   ├── handler.rs
│   ├── context.rs
│   ├── outcome.rs
│   └── noop.rs
├── remediation/
│   ├── executor.rs
│   ├── kill.rs
│   ├── quarantine.rs
│   ├── isolation.rs
│   ├── verdict.rs
│   ├── audit.rs
│   └── types.rs
├── enrollment/
│   ├── identity.rs
│   ├── keystore.rs
│   ├── certmanager.rs
│   ├── stepca.rs
│   ├── tls.rs
│   ├── fingerprint.rs
│   ├── metadata.rs
│   └── startup.rs
└── utils/
    ├── process_tree.rs
    ├── bloom_filter.rs
    ├── hash.rs
    ├── pipe.rs
    ├── path.rs
    ├── install.rs
    ├── executable.rs
    └── user_resolver.rs

External communication

The diagram shows the wires. This table describes what actually crosses each one, the external processes the agent talks to, what moves, and over which protocol. Internal module-to-module calls are omitted.

Module layout (service)

What each module and subsystem is responsible for.

Entry / host:

Subsystems:

Configuration

The agent takes all of its configuration from environment variables, read once at startup into a global configuration singleton. There is no configuration file the agent parses itself.

How those variables are set depends on the install path:

• Normal (dashboard) install. The installer provisions the credentials and writes the configuration for you, so there is nothing to set by hand.
• Manual install. You write the variables yourself as the service’s registry Environment value, which the Service Control Manager injects into the process when it starts.

The mandatory variables are:

For the full procedure and every available setting, see Manual Installation → Configuring the Agent in the Installation Guide.

Library inventory

Key third-party libraries the agent depends on, for traceability when reading the code.