Arkesilaos

What it is

Arkesilaos is a personal-use telemetry and protection platform for a single Windows workstation — deliberately not a product. It exists because the interesting engineering in endpoint security lives below the tools you can buy: raw kernel telemetry, a detection engine you can read, and enforcement you can always undo.

The platform splits into two halves. The detection half — collectors → store → detectors — is built and strong. The prevention half — graduated hardening with reversible enforcement — is live and growing control by control.

Architecture

┌────────────────────────────────────┐
│  Console  (Tauri · user session)   │
└───────────────┬────────────────────┘
                │  named pipe · NDJSON, bidirectional
┌───────────────┴────────────────────┐
│  Daemon  (Rust, elevated)          │
│  event store · collectors ×9       │
│  detection engine · policy ladder  │
└───────────────┬────────────────────┘
                │  planned
┌───────────────┴────────────────────┐
│  Kernel network filter (WFP)       │
└────────────────────────────────────┘

Fig. 1 — the console is restartable; the daemon is the brain

Logic lives in user mode. The UI is an unelevated viewer that reaches the elevated daemon over one named pipe; every read routes through that protocol because the event store's writer holds an exclusive lock. Storage is split by job: a columnar store for high-volume event data and aggregation windows, an embedded relational store for durable state — config, baselines, and the action log.

Detection

Nine ETW collectors cover process, network, registry, and file activity, plus Sysmon-enriched events, AMSI scan content, WMI activity, DNS queries, and PowerShell script blocks. Each collector is self-contained and opportunistic — a source that fails to start downgrades to a warning and the daemon continues without it.

The Sigma engine is built, not a library choice. At boot it compiles YAML rules to parameterised SQL through a field-mapping layer, then evaluates the just-flushed event window on every batch tick. It supports the operative Sigma subset — equality, contains/startswith/endswith modifiers, boolean logic, wildcard groups — plus temporal correlation: two sub-rules matched within a symmetric window, grouped by process, so multi-step behavior fires as one detection.

Detections render like log entries in a publication, not toast notifications — rule, MITRE technique, evidence event IDs, action taken. Severity is communicated by typographic weight, never color.

Prevention — the enforce ladder

There is no big "lockdown" switch. Each security control climbs a per-control ladder:

• Observe— a poller reads the host's effective security posture on a fixed cadence and emits change-log events. Desired state is expressed as rules, so a gap surfaces like any other detection.
• Enforce — an opt-in, reversible mutation path. The dispatcher gates, snapshots prior state, writes the intent before mutating, mutates, verifies by re-read, and records a durable action row. Undo works from the row alone and survives a restart. De-escalation is never gated.
• Maintain — enforce plus automatic re-assertion on observed drift, with backoff so a wedged control surfaces as a detection rather than thrashing the log.

The audit trail is the point: every mutation is an append-only record with prior state, target, outcome, and undo provenance — the same discipline Ataraxia applies to compliance data, applied to a live operating system.

Status

Detection half built end to end — collectors, store, engine, live investigation console. Prevention half live with the ladder proven on real controls and growing. Network subsystems (local DNS filtering, kernel network filter) and an AI-assisted investigator are designed and planned. In active development.