Endpoint Detection

The endpoint agent scans new files with a real signature and hash detection engine backed by a per-tenant intelligence feed synced from the control plane.

What it does

• SHA-256 hash reputation against a known-bad set
• byte-signature matching over a bounded file head
• optional YARA rule matching where yara-python is installed (graceful no-op otherwise)
• control-plane-synced intel, so the detection feed grows without shipping a new agent build
• fails open by design — an unreadable file or malformed intel returns "no detection," never an error into the monitor

Detection intel feed

Intel is managed centrally and synced to endpoints, then loaded from a local file the engine reloads on change (no agent restart needed). The feed carries:

• sha256 — known-bad hashes with optional name / severity / detail
• byte_signatures — hex content patterns with severity
• yara_rules — an optional YARA rule source string

Managing the feed

Endpoint	Audience	Purpose
GET /signature-intel/{tenant_id}	agent (api-key)	fetch the feed to sync locally
GET/PUT /tenant-signature-intel/{tenant_id}	admin	manage a tenant's feed
GET/PUT /customer/signature-intel	tenant admin	maintain the tenant's own IOCs

All writes are validated: SHA-256 format, even-length valid hex signatures, known severities, and bounded counts.

Bundled seed

The engine ships with the EICAR antivirus test string as a seed, so the detection path is demonstrable out of the box without handling live malware. Drop an EICAR test file into a monitored directory to confirm detection end to end.

Validation checklist

• PUT /customer/signature-intel accepts a valid feed and rejects malformed hashes
• an EICAR test file in a watched path produces a malware_signature_detected event
• revoking a hash from the feed removes detection at the next scan without an agent restart

See also Endpoint Agent and Patch Management.