Store the selected facts.
AEF1 replaces repeated syntax with typed values and dictionary references. Compact facts remain inspectable in the console.
SECURITY INTELLIGENCE / INFRASTRUCTURE R&D
A datacenter,
reimagined.
One rack. A complete research frontier.
Athernex brings security intelligence, agent authority, and infrastructure orchestration into one vision. Built in Rust. Designed to make every resource count.
AVAILABLE TODAYSingle-host Rust SIEM + agent gateway
ATHERNEX / SYSTEM CONCEPT 001
ONE RACK. SHARED INTELLIGENCE.Architecture vision · not a hardware specification
01Rust at the coreA working security control plane
02Evidence before actionInvestigations with a decision trail
03Task-sized authorityAccess that expires with the work
04Efficiency by designExplicit memory and storage budgets
01 / THE WORKING FOUNDATION
Signal over noise.
Control over complexity.
A SIEM you can actually investigate.
From a Linux event to a preserved case. From an agent request to an accountable decision.
ATHERNEX / RUST CONTROL PLANE ACTUAL CONSOLE CAPTURE
SEE THE OPERATING PICTURE
One signal. All the way to its evidence.
Explore real source health, five explicit detection rules, and investigations linked to the facts that raised them.
Explore the platformReal Rust console. Controlled public fixtures. These captures are a product tour, not a live connection to the lab.
02 / THE ONE-RACK VISION
Make the rack
a system.
Security, compute, storage, and agent work should understand each other’s limits.
The ambition is a datacenter in one rack: an inspectable control plane coordinating resources instead of adding another disconnected service. The SIEM is the foundation. The connections are the research.
Read the research roadmapTHE SYSTEM, LAYER BY LAYERSELECT TO EXPLORE ↓
AVAILABLE / SINGLE-HOST
Start with what actually happened.
Collect Linux system and authentication events, correlate selected facts, and preserve evidence in an analyst-owned investigation.
Inspect the implementation03 / A SMALLER FOOTPRINT. A CLEARER CONTRACT.
Every byte has
to earn its place.
Efficiency is more than a smaller log.
It is knowing what you keep, what it costs, and which questions it can still answer.
EXPERIMENT / SEMANTIC COMPACTIONAEF1
AU−
s3:18→4A readable notation over typed binary facts.
Authentication Outcome Referenced identities
The notation is a view. The complete stored event includes the fields required by its detection contract.
Give history a ceiling.
A hot RAM window feeds a rolling compressed archive. Set a time horizon and capacity; the first limit reached controls rotation.
Account for the whole bill.
Provenance, dictionaries, copied evidence, database pages and WAL all cost space. Payload savings are only one part of the measurement.
4,096facts in the default hot window
1 MiBdefault compressed archive payload cap
See the measurements
Defaults, not throughput claims. Physical storage adds overhead. Whole-rack performance remains to be measured.
04 / THE NEXT CONNECTION
MIGRATION IN PROGRESSEndpoint protection.
A shared picture.
Project Crustation is moving toward the agentic SIEM and orchestration layer. The source project, Crustacian, combines Rust endpoint tooling, ClamAV scanning, and durable telemetry.
Follow the migration01Keep scanning local.
Endpoint AV and its evidence stay close to the machine.
02Bring the facts together.
Preserve full identities, evidence hashes, and durable delivery.
03Govern the response.
The compatibility bridge and endpoint response path are planned work.Planned: reviewed, scoped commands enforced at the endpoint.
A FEW USEFUL ANSWERS
Know what
you’re exploring.
Can I run the SIEM today?
Yes. The lab includes a working single-host Rust SIEM, a local console, and a systemd user-service installer. Linux journald is the first live source. Start with the quick-start guide, or use the separate demo mode to explore with synthetic events.
Does the hive launch autonomous agents?
The current hive registers agent identities, assigns tasks, and enforces expiring access to exact SIEM resources. It records decisions and supports revocation and quarantine. It does not launch worker processes or authorize arbitrary host and endpoint actions.
Is the entire datacenter already running in one rack?
One rack is the research direction. The working SIEM and separate orchestration components are concrete foundations. Their integration, shared resource budgets and rack-scale performance still need to be demonstrated and measured.
Where can I see the implementation and contribute?
The public lab repository contains the Rust code, tests, research findings and roadmap. Open an issue with a reproducible finding or connect with Charles on LinkedIn to discuss the project.
INDEPENDENT RESEARCH. OPEN CONVERSATION.
Building the next layer.
Let’s compare notes.
Athernex is a systems research project by Charles D. Gonzalez. Interested in Rust, security engineering, endpoint protection, or making infrastructure do more with less?