Synthaea is an open-source XDR with on-device ML detection, case-based correlation, and a metamorphic agent that defends itself. Open, without handing attackers a map.
The gap
Excellent telemetry, excellent rule engines, and essentially nothing else. On-device ML and agent self-protection are empty across the field: commercial vendors treat both as crown jewels and ship them only as closed binaries.
| Tool | Telemetry | Rule detection | Response | On-device ML | Agent self-protection |
|---|---|---|---|---|---|
| OSQuery | — | — | — | — | |
| Velociraptor | hunt-time | partial | — | — | |
| Wazuh | partial | — | — | ||
| Falco | Linux | partial | — | — | |
| Sysmon + Sigma | — | — | — | ||
| Synthaea (goal) | inline |
The thesis
A rule engine is public and static. Download the rules and the binary, and you can work out offline what the defender sees and how to blind it. Synthaea makes both attacks expensive, independently.
Adaptive immunity
A rule enumerates conditions; a model interpolates between them, flagging variants nobody wrote a rule for. Weights ship open. The part an attacker can't reproduce is fleet-derived: rarity and per-tenant baselines from your own data.
Unique DNA per install
Analysis of one installation does not transfer to the next. There is no stable process name, service name, file path, byte pattern or function offset to hardcode into a killer.
Randomization, not obscurity.
The mechanism is published; what differs per install is a small, rotatable seed, the way ASLR, stack canaries and password salts work. The rule that settles it: no capability depends on the secrecy of code or design, and base capability survives total disclosure of every key.
Product
Every capability is labelled with where it stands today. Anything without code behind it is a design goal.
eBPF on Linux, ETW on Windows, EndpointSecurity on macOS: each platform a module behind one formal sensor contract. No reference platform.
A rule engine mapped to ATT&CK techniques such as T1055, T1059, T1071 and T1105. Public, reviewable, exportable.
ONNX inference on the endpoint, plus temporal correlation scored with Isolation Forest and Bayesian log-likelihood ratios.
Detections become evidence, correlated into one object per campaign across hosts, users and time. The machine does the correlation, not the analyst.
Block, kill or quarantine on the endpoint, and drive response across identity, network, email and cloud, scoped to the case.
Per-tenant builds with no stable process name, service, path, byte pattern or offset to hardcode into a killer. Integrity, watchdog, anti-tamper.
How it works
Kernel events flow through a ring buffer into a normalizer, then into a bounded process graph on the endpoint.
Rules, on-device models and local correlation reach a verdict where the activity happens, not minutes later in a SIEM.
The verdict acts inline, while the morph runtime watches the agent itself for tampering.
The control plane folds detections into cases alongside identity, network, email and cloud signals, and drives the response.
Contain this case
An honest word
Against SYSTEM or root with a vulnerable signed driver, no user-mode technique wins. What it does defeat is worth a great deal: commodity killers with hardcoded names, offline reverse engineering that transfers across a fleet, and signature-based agent identification during reconnaissance.
The real defense against a kernel adversary is kernel-level (PPL/ELAM, SIP, LSM) plus a server-side heartbeat, because agent silence is itself a detection.
Scope
Status
Early implementation. The specification is the authoritative design reference; the code is catching up to it.
Most of Synthaea is still at the design stage: the best time to argue about the foundations. Follow the build as it happens.
Apache-2.0 throughout · eBPF probes GPLv2 (a kernel constraint) · DCO, no CLA