A platform, not a lone agent

It reads the binary's internal information to find where the data it cares about lives. If that is missing, it runs the binary for a few moments in an isolated environment and watches it from inside the system until it works it out. From that it produces a signed map of that specific binary and applies it live, with no restart. A watcher spots new binaries by their fingerprint and launches the whole process by itself, with room for up to 16 different versions or builds living side by side on the same machine, each with its own calibration. The same goes for libraries that appear later —a database driver, a crypto library—: it hooks them in seconds.

Agents report observations, never labels: compromising an agent cannot move the model. The central merges them, removing duplicates and with caps that stop any single one from skewing it, and a statistical test decides whether an improvement is solid: it only ships if it does not raise the current false-positive rate. Heavy retraining happens outside your production servers.

Models and reputation lists are packaged cryptographically signed, travel encrypted between your machines, and each agent verifies signature and content before installing them, in an instant switch with no downtime. The reputation one server learns goes into the same place where everyone else's lives.

The panel reads a sealed feed produced by the agent itself. The analyst's work —flag, annotate, close— lives in a separate layer that never touches the original evidence, which is immutable and chained, and has its own audit trail. Output goes straight out in your SIEM's format: ECS for Elastic and CEF for ArcSight or Splunk, with no adapter to write. And for day-to-day work there is an admin command line, health checks and standard metrics your monitoring already knows how to read.

It only accepts signed orders with an increasing sequence number, so nobody can replay an old one; and if it stops hearing from control, it returns to its safe configuration by itself. On machines with a security chip (TPM) it also measures its own components at startup and leaves a fingerprint that cannot be faked, which the central verifies remotely: the agent's integrity is not taken on trust, it is checked.

It verifies the signature and rejects the update if it is not valid. It backs everything up —binary, configuration and models—, swaps the binary in one go, migrates your configuration while respecting your settings, and restarts. And it does not call the update good until it has confirmed the new agent started and is really watching: if any step fails, it undoes everything automatically and leaves the server as it was.