Tamandua Core

Cross-platform connectivity and detection library for Tamandua EDR.

Overview

tamandua-core is a shared Rust library that provides core EDR functionality across all platforms (Windows, Linux, macOS, iOS, Android). It follows the design pattern established by Firezone's connlib, separating platform-agnostic core logic from platform-specific implementations.

Architecture

┌─────────────────────────────────────────┐
│         Application Layer               │
│  (Desktop/Mobile/Embedded Agents)       │
└─────────────────────────────────────────┘
                   │
                   ▼
┌─────────────────────────────────────────┐
│         Tamandua Core Library           │
│  - Telemetry Collection                 │
│  - Detection Engine                     │
│  - Response Executor                    │
│  - Transport Manager                    │
└─────────────────────────────────────────┘
                   │
                   ▼
┌─────────────────────────────────────────┐
│       Platform Abstraction Layer        │
│  (Windows/Linux/macOS/iOS/Android)      │
└─────────────────────────────────────────┘

Features

• full (default): Enable all features
• telemetry: Event collection and batching
• detection: YARA, heuristics, ML integration
• response: Process termination, quarantine, isolation
• transport: WebSocket connectivity to backend
• mobile: iOS/Android optimizations
• embedded: Embedded device support

Usage

Basic Example

use tamandua_core::{TamanduaCore, AgentConfig};

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    // Create configuration
    let config = AgentConfig::default();

    // Initialize agent
    let mut agent = TamanduaCore::new(config).await?;

    // Start agent
    agent.start().await?;

    // Agent runs until stopped
    tokio::signal::ctrl_c().await?;
    agent.stop().await?;

    Ok(())
}

Mobile Integration (iOS/Android)

use tamandua_core::{AgentConfig, TamanduaCore};

// Mobile-optimized configuration
let mut config = AgentConfig::default();
config.telemetry.batch_size = 50;
config.telemetry.collection_interval_ms = 5000;
config.detection.ml_enabled = false; // Save battery

let mut agent = TamanduaCore::new(config).await?;
agent.start().await?;

C FFI (for Swift/Kotlin)

#include "tamandua_core.h"

// Create agent
TamanduaAgent* agent = tamandua_agent_new();

// Start agent
tamandua_agent_start(agent);

// Get status
char* status = tamandua_agent_status(agent);
printf("Status: %s\n", status);
tamandua_string_free(status);

// Stop and cleanup
tamandua_agent_stop(agent);
tamandua_agent_free(agent);

Platform Support

Platform	Status	Notes
Windows	✅ Full	Complete process, file, network, registry monitoring
Linux	✅ Full	Auditd integration, /proc parsing
macOS	✅ Full	FSEvents, EndpointSecurity framework
iOS	⚠️ Limited	Sandboxed, network monitoring only
Android	⚠️ Limited	Sandboxed, limited process access

Configuration

[package]
name = "your-agent"
version = "0.1.0"
edition = "2021"

[dependencies]
tamandua-core = { version = "0.1", features = ["full"] }
tokio = { version = "1.35", features = ["full"] }

Feature Flags

# Desktop agent (full features)
tamandua-core = { version = "0.1", features = ["full"] }

# Mobile agent (optimized)
tamandua-core = { version = "0.1", features = ["mobile", "telemetry", "transport"] }

# Embedded agent (minimal)
tamandua-core = { version = "0.1", features = ["embedded", "telemetry"] }

# Detection-only (no transport)
tamandua-core = { version = "0.1", features = ["detection"] }

Building

# Desktop agent
cargo build --release --features full

# Mobile (iOS)
cargo build --release --target aarch64-apple-ios --features mobile

# Mobile (Android)
cargo build --release --target aarch64-linux-android --features mobile

# Embedded
cargo build --release --target armv7-unknown-linux-gnueabihf --features embedded

Testing

# Run all tests
cargo test --all-features

# Run integration tests
cargo test --test integration_test

# Run platform tests
cargo test platform::tests

Examples

# Embedded agent example
cargo run --example embedded_agent --features full

# Mobile integration example
cargo run --example mobile_integration --features mobile

API Documentation

Generate documentation:

cargo doc --all-features --no-deps --open

Performance

• Memory: ~10MB baseline, scales with event queue size
• CPU: <1% idle, 2-5% during active collection
• Network: Batched compression reduces bandwidth by 60-80%
• Battery: Mobile-optimized mode extends battery life by 40%

Security

• TLS 1.3 for all transport
• mTLS certificate pinning supported
• File quarantine uses encryption at rest
• Memory-safe Rust implementation
• No unsafe code in core logic (platform APIs use minimal unsafe)

License

MIT OR Apache-2.0

Contributing

See CONTRIBUTING.md

Related Projects

• Firezone connlib - Inspiration for architecture
• Osquery - Endpoint visibility
• YARA - Pattern matching