Proto Contracts

Repo: AnyProto (protobuf, Buf). The central wire ABI, consumed everywhere as the anyproto crate (prost messages + tonic stubs). Two concerns live here: the control channel between agent and gateway, and the OCSF telemetry schema.

Proto tree

Control channel (endpoint/v1/endpoint.proto)

One service, one bidirectional stream — there is no separate enrollment or telemetry service here (enrollment rides in-band on Hello.shared_enrollment_secret; telemetry lives in ocsf.v1).

service EndpointService {
  rpc EndpointChannel(stream EndpointChannelRequest)
                returns (stream EndpointChannelResponse);
}

• Hello — endpoint_id, mac_addr, public_key (bytes), shared_enrollment_secret, HelloMetadata (hostname, os, agent_version, mac_addresses[], machine_uuid). First frame.
• Command — endpoint_id + bytes raw (opaque, backend-signed).
• TrustBundle — endpoint_id + bytes raw (anchor-signed signing-key bundle).
• CommandResult — command_id, ResultStatus (OK/ERROR/SIG_ERROR/TARGET_REJECTED/EXPIRED), detail.

OCSF telemetry (ocsf/v1/)

The schema is not one message per class. There is a single flat OcsfEvent (event.proto) with a class_uid discriminator and many optional object fields; each field is annotated with the class_uid that populates it. The telemetry service is OcsfEventService with unary OcsfBatch(OcsfBatchRequest{agent_id, events}) → OcsfBatchResponse{accepted, rejected, errors} (ocsf.proto).

Class UIDs actually used (verified against event.proto — note the corrections from earlier project docs):

Corrections vs older docs: Module is 1005 (1006 is ScheduledJob); remediation is 7003; there is no 999999 agent-lifecycle class in the proto.

Streaming/ML messages (EnrichedEvent, WindowResult, AnomalyDetected) and the enrich.v1 IpReputation type also live here but belong to downstream correlation, out of this project’s scope.

Consumption

Consumed as a git dependency tracking main (or pinned to a rust/v… tag):

anyproto = { git = "https://github.com/MarkAny-GaneshaIT/AnyProto", branch = "main" }

Buf codegen (buf.gen.yaml) runs neoeinstein-prost + neoeinstein-tonic + a crate generator; the generated crate is committed at gen/rust/ and CI regenerates it on push. Cargo features endpoint-v1, enrich-v1, ocsf-v1 (+ proto_full) let a consumer compile only the packages it uses.