System Overview
The AnyOne EDR system at a glance: a context view of the whole platform and the outside actors it touches, plus a repository map linking each in-scope repo to its own structure page.
System context
ℹ️ Arrow colors:
- Blue : data plane (telemetry flow)
- Orange : control plane (commands, enrollment, and remediation actions).
The two planes
Traffic between endpoint and backend splits into two planes, and that split is the core of the security model:
- Data plane (up). The agent ships OCSF telemetry to the gateway over one gRPC service and holds a second, long-lived bidirectional gRPC stream for control and liveness. File verdicts take a separate HTTPS path to the Static Analysis API. All three are mTLS. Everything the endpoint sends is a report. It issues no commands upward.
- Control plane (down). Response actions (kill process, quarantine file, isolate host) originate at the SOC backend, which Ed25519-signs each command, and flow down through Kafka and the gateway to the agent. The gateway is the only endpoint-facing service that touches Kafka, and it never parses command bodies. It forwards them as opaque, backend-signed bytes (see Command Trust). Trust bundles ride the same downward path.
Repository map
| Repo | Language | Role | Runs on | Page |
|---|---|---|---|---|
| AnyOne-Endpoint | Rust | AnyOneAgent service for telemetry, the OCSF pipeline, static-analysis orchestration, remediation, and enrollment. Primary repo. | Endpoint | Endpoint Agent |
| AnyOne-Kernel | C | AnyOneKcallback (kernel-callback and WFP telemetry) and AnyOneMinifilter (file-system minifilter). | Endpoint | Kernel Drivers |
| AnyGateway | Rust | gRPC gateway that terminates agent mTLS and bridges telemetry and enrollments up to Kafka, and commands and trust-bundles back down. | Backend | Gateway |
| AnyOne-StaticAPI | Rust | Static file-analysis service with a gateway and worker, backed by Redis and Postgres. | Backend | Static Analysis API |
| AnyOne-SOC-Backend | Rust | Orchestrator behind the SOC dashboard that ingests alerts, enrollments, and results, dispatches signed commands, issues enrollment, and distributes trust bundles. | Backend | SOC Backend |
| AnyProto | proto | Central protobuf contracts (anyproto crate), the wire ABI between agent and gateway, plus the OCSF telemetry schema. | (compiled into consumers) | Proto Contracts |
| AnyOne-Infra | yaml/docker | Deployment config. Out of scope. | n/a | n/a |