Cybersecurity
I built a Rust security information and event management system: from event ingestion and correlation to investigations, evidence retention, and bounded agent authority.
ORIGINAL CONTRIBUTIONS
Athernex / SYSTEM MAP
SYSTEMS DESIGN & OWNERSHIP
Implemented the Rust pipeline from normalized event admission through detection, correlation, findings and investigation. The design gives event identity, provenance and evidence retention explicit representations so a finding can be traced back to the records that produced it.
SQLite WAL and transactional batches protect admitted events. Compact AEF1 encoding and compressed retained blocks trade encoding complexity for explicit storage accounting. The replay-identity repair prevents different source/key pairs from aliasing and preserves deduplication after archive restoration.
Task-bound grants constrain the resource, action, lifetime and use count available to an agent. Authenticated operator and CSRF boundaries remain separate. HTTP tests exercise concurrent consumption of the final permitted use rather than relying only on a UI check.
EXPLORE THE ARCHITECTURE
ATHERNEX · SINGLE LOCAL TRUST DOMAIN
Normalize permitted event inputs.
Implementationjournald parsing or validated InputEvent batches enter the engine.
Security & failure behaviorTrusted collector provenance differs from token-scoped remote ingest. Invalid fields, oversized batches and unauthenticated API inputs are rejected.
TradeoffBounded schema limits payload flexibility and makes field budgets explicit.
Validate events and correlate findings.
ImplementationTransactions persist labels, payloads and idempotency hashes; detection rules evaluate retained events.
Security & failure behaviorConflicting replay facts fail atomically. A failed batch rolls back; storage limits surface errors.
TradeoffSingle-process serialization simplifies correctness; horizontal scale is unverified.
Keep inspectable evidence under retention budgets.
ImplementationSQLite WAL, compact AEF1 payloads and compressed retained blocks.
Security & failure behaviorEvidence hashes bind response proposals to their evidence. Unflushed telemetry is memory-only; full storage fails closed.
TradeoffPayload compression is not equivalent to total on-disk storage savings.
Allow agents only task-scoped evidence access.
ImplementationGrant digest lookup, expiry and use limits checked in a transaction.
Security & failure behaviorAgent grants never authorize operator console access or host tools. Expired, revoked, exhausted or mis-scoped grants deny access.
TradeoffLocal task grants are not a general distributed identity provider.
THE WORKING APPLICATION
TECHNICAL CASE STUDY
Turn bounded host and synthetic security telemetry into inspectable findings while keeping agent permissions separate from operator authority.
Atomic event batches, explicit replay handling, bounded memory and storage, and an investigation path that never grants an agent host authority.
Rust / Axum HTTP; SQLite WAL ledger; AEF1 varint event encoding; flate2 retained blocks; SHA-256 evidence hashes; journald collector. The replay uses an in-memory engine.
Operator authentication and CSRF protect console mutations. Task-bound grants have resource, action, lifetime and use-count limits. Ingest identities cannot impersonate trusted journal collectors.
Repository history records charlesderek implementing the SIEM engine, normalized event codec, durable admission and console. Scope is this independently implemented subsystem; dependencies retain their own authorship.
Batch validation, idempotency fencing, five detection rules, evidence-backed findings, proposal review, bounded retention, scoped capabilities, and an operational console are present in source.
Datacenter orchestration and research screens do not establish production orchestration. No production scale or load test is claimed. Cross-platform host collection is not verified by this replay.
Invalid batches and conflicting replays roll back; exhausted capability grants deny access. SQLite transactions serialize ledger changes. HTTP tests exercise simultaneous last-use consumption.
Baseline executed locally: 39 library tests and 9 HTTP integration tests passed on Linux. Fixed-clock Rust replay exports 12 synthetic events, correlated findings, and allow/deny capability decisions.
This cycle replaces ambiguous source:key replay identities with an unambiguous separator and normalizes legacy retained identities on restore. Colon-containing source/key pairs previously collided. Regression and migration tests verify independent identities and retained replay protection.
Single local Rust process with SQLite and a local operator console. The public portfolio hosts captured fixture output; no production agent or operator endpoint is exposed.
A bounded single-ledger model makes transactional behavior inspectable. A distributed event bus would add availability and ordering tradeoffs that this demonstration does not validate.
Use the Evidence Lab below to inspect actual replay output. Data is synthetic; no host journald collection, privileged response, or production performance claim is part of this demonstration.
ENGINEERING SCOPE
Verified original Rust SIEM implementation scope; third-party dependencies excluded.