Extended detection and response, from kernel to console
An XDR platform on a Go microservices backend that watches every laptop and server at kernel level, correlates findings across the fleet into incidents and lets analysts respond in seconds.
- Client
- Enterprise security vendor
- Industry
- Cybersecurity
- Delivered
- 2026
- Platforms
- Linux, macOS and Windows agents · Web console · gRPC and REST APIs
- Desktop platforms protected
- 3
- Sigma and YARA detection rules
- 660+
The challenge
Security teams needed one place to see what is happening on every endpoint, spot real attacks among millions of events and act before damage spreads, without an agent that slows machines down or can be switched off by an attacker.
Our approach
We built a lightweight Go agent for each operating system on native kernel telemetry, normalised events to the OCSF standard and streamed them over mutually authenticated gRPC into a microservices backend. Independent Go services handle enrolment, ingest and correlation, connected through Kafka and backed by ClickHouse and Elasticsearch, so each part scales and ships on its own.
What we built
- Kernel-level telemetry through eBPF on Linux, Endpoint Security on macOS and ETW on Windows
- Sigma and YARA rules alongside behaviour detectors for ransomware, privilege escalation and lateral movement
- Twelve signed machine-learning models that score files and behaviour on the device, even offline, with optional AI verdicts for analysts
- Keeps detecting offline, buffering telemetry until the connection returns
- Go microservices for enrolment, ingest and correlation on Kubernetes, deployed with Argo CD and traced end to end with OpenTelemetry
- Server-side correlation that groups related findings into a single incident
- Response actions such as killing processes and quarantining files, with approvals and rollback
- Per-agent certificates over mutual TLS, strict tenant isolation and a hash-chained audit trail
Technology
- Go
- Microservices
- eBPF
- Kafka
- ClickHouse
- gRPC
- Kubernetes
Have a platform like this in mind?
Tell us where you want to go. We'll come back with senior engineers, a clear plan and honest numbers.
What happens next
- 1
A reply within one business day
A senior engineer reads your brief and replies with real questions, not a sales script.
- 2
A focused discovery call
Thirty minutes on your goals, constraints and what success should look like.
- 3
A clear, shareable plan
Scope, team shape, timeline and cost, written up so you can take it to your board.