Kernel telemetry
Linux CN_PROC netlink process events and fanotify/inotify file activity, a Windows ETW consumer, and an opt-in macOS Endpoint Security client — with polling fallback.
v1.1.0Real kernel telemetry, Tantivy search, WASM extensions
Security operations you actually own.
Wardex is a private-cloud XDR and SIEM built in Rust. Detection, investigation, threat hunting, fleet operations and governance ship as one signed binary — on your infrastructure, with no telemetry egress unless you enable it.
- Signed releases
- SLSA provenance
- CycloneDX SBOM
- AGPL 3.0 source
Why Wardex
Three things most XDR platforms can't offer.
Wardex is built for security teams that need professional tooling without handing their telemetry to a vendor.
Data sovereignty by default
Your telemetry never leaves your infrastructure. Deploy on-prem, in your VPC, or air-gapped. Every integration — SIEM, IdP, threat feeds — is yours to configure or disable.
Memory-safe Rust, one binary
Rust edition 2024, MSRV 1.88. No runtime to manage, no JVM to patch, no Python toolchain drift. A single reproducible binary serves agents, API, and the browser console.
Verifiable supply chain
Every release ships with SLSA build provenance attestations, CycloneDX SBOMs, and cosign-signed container images. CI is SHA-pinned and secret-scanned on every push.
New in v1.1.0
Documented capabilities, now real implementations.
v1.1.0 replaces placeholders with working engines and hardens them after a full code review. Where a capability depends on platform privileges, we say so.
Tantivy full-text search
/api/search and /api/hunt run on a real Tantivy index instead of an in-memory re-scan.
YARA rule compiler
A native .yar compiler for a documented subset of YARA syntax, alongside the existing JSON rule format.
Learned triage
Random Forest triage (CART, bootstrap, out-of-bag evaluation) trained from analyst feedback, plus federated averaging with differential privacy.
WASM extensions
Sandboxed third-party extensions on wasmi: fuel-metered, no JIT, versioned host ABI.
Integrations
VirusTotal and AbuseIPDB enrichment, bidirectional Jira and ServiceNow ticketing, OTLP export, SMTP STARTTLS, Okta polling, Docker/Podman and Kubernetes event sources.
| Platform | Primary source | Verification status |
|---|---|---|
| Linux | CN_PROC netlink + fanotify/inotify, /proc fallback | CI-tested |
| Windows | ETW consumer (requires an elevated agent), polling fallback | Not yet exercised on an elevated host |
| macOS | Endpoint Security behind the opt-in macos-es feature (Apple entitlement required) | Not CI-verified |
| eBPF | Not implemented | Not available |
Platform Capabilities
Detection, investigation, and response — integrated.
One platform covering the full SOC lifecycle. Every surface is driven by the same data model and permission system.
Real-Time Detection
Adaptive scoring, Sigma rules, compiled YARA rules, and kernel event telemetry feed a single per-event risk assessment.
Threat Hunting
Campaign clustering across the fleet, deception canaries, attacker profiling, and memory forensics for proactive investigations.
SOC Workbench
Queue, cases, SLAs, process trees, timelines, and storyline views keep analysts inside one investigation surface with full context.
File Integrity Monitoring
SHA-256 baselines for critical system paths with change detection and per-agent snapshots across Linux, macOS, and Windows.
UEBA & Geo-Validation
Behavioural baselines with impossible-travel detection catch compromised credentials that static rules miss.
Approval-Gated Response
Quarantine, isolate, and remediate with documented approvals, full audit trails, and automatic rollback on failure.
Insights
Inside Wardex: live operator views from a real control plane.
Captured from a recent local Wardex instance with seeded alerts, enrolled endpoints, active incidents, and an in-progress hunt. No static mockups.
One control plane for posture, triage, fleet recovery, and hunt workflows.
Live local capture
Seeded alerts + incidents
Fleet + hunt context
Wardex keeps detection, investigation, and endpoint operations inside the same product surface. Analysts do not have to swivel between stitched-together tools to move from an alert to a host, a case, or a hunt.
- Dashboard posture, fleet state, and threat volume share the same data model.
- Fleet recovery stays next to version drift, heartbeat loss, and rollout status.
- Incidents, cases, and hunts remain linked to the same endpoints and evidence.
Fleet Operations
Spot version drift and offline endpoints in one sweep.
Version lag, heartbeat gaps, and endpoint detail stay visible without leaving the fleet workspace.
Incident Response
Move from incident list to action plan without another tool.
Open incidents carry linked agents, narrative context, and next-response actions inside the same SOC workbench.
Threat Hunting
Pivot into live hunts directly from rule context.
Run an ad hoc hunt, reuse the query, and widen scope from the same detection engineering surface.
By the Numbers
Measured, not marketed.
Counts are generated from the v1.1.0 source tree and test suites.
Deploy Anywhere
Linux. macOS. Windows. Air-gapped.
Run a single binary under systemd, launchd, or as a Windows Service. Every channel below is published from the same signed release pipeline.
- GitHub release archives with checksums, SBOM and provenance
- Signed APT repository and RPM packages
- Homebrew tap for macOS and Linux
- Cosign-signed container image on GHCR
- Helm chart for Kubernetes rollouts
- Auto-update with SHA-256 verification and atomic rollback
# Linux (Debian / Ubuntu) $ curl -fsSL https://pinkysworld.github.io/Wardex/apt/pubkey.gpg \ | sudo gpg --dearmor -o /usr/share/keyrings/wardex.gpg $ sudo apt install wardex # macOS $ brew tap pinkysworld/wardex $ brew install wardex # Kubernetes $ helm install wardex ./deploy/helm/wardex ok ready to serve
Own your detection stack.
Evaluate Wardex in your own environment today. The source code is open under AGPL 3.0 — commercially licensed for production deployments.