GARGOYLE
A Rust-based Linux and Windows security observer that correlates host activity into a normalized event contract while deliberately refusing to become a remote command framework.
Problem
Useful host telemetry gets complicated quickly once process identity, network ownership, authentication, local accounts, executable fingerprints, and multiple operating systems enter the picture. GARGOYLE builds that context while keeping collection bounded, auditable, and read-only.
Constraints
- Support Linux and Windows without weakening the event contract or interpolating observed host text into command programs.
- Keep privileged collection bounded in memory, runtime, file reads, snapshots, and queue behavior.
- Disable sensitive command-line capture by default and avoid remote execution capability entirely.
- Make release artifacts reproducible and reviewable through pinned dependencies, CI, checksums, SBOMs, and attestations.
Architecture
- 01
Platform adapters collect process, socket, file, identity, authentication, kernel, and health state, then attach executable identity where relevant.
- 02
Collectors submit normalized gargoyle.event/v2 objects through a bounded nonblocking channel instead of writing directly to outputs.
- 03
One pipeline thread applies policy and serializes events to stdout, JSONL, or Unix datagram outputs.
- 04
Linux and Windows deployment assets harden service execution while platform-specific adapters remain behind a shared event model.
Failures / lessons
- Observability software needs its own resource ceilings; a security sensor that can exhaust the host becomes part of the incident.
- Cross-platform support works better when the contract is shared but the host adapters are allowed to be native.
- Read-only telemetry is a meaningful security boundary, not merely a missing feature.