Wardex

Wardex (pinkysworld/Wardex) is a Rust-based XDR and SIEM platform for private-cloud and self-hosted security operations. It brings telemetry collection, detection engineering, malware analysis, analyst workflows, approval-gated response, fleet management, evidence handling, and release verification into one deployable product.

Why Wardex

• Own the control plane: run the console, APIs, telemetry, and evidence workflows in your own environment.
• Investigate in one place: triage alerts, inspect threads/processes, pivot into cases, and keep source evidence attached.
• Respond with guardrails: use approval-aware actions such as block IP, isolate host, kill process, quarantine file, disable account, and rollback.
• Scan across platforms: malware, virus, trojan, and rootkit workflows cover Linux, macOS, and Windows with local engines plus optional open-source signature presets.
• Ship verifiably: releases include checksums, SBOMs, provenance, signed artifacts, and documented verification gates.

Current Release: v1.0.30

This release is a persistence-consolidation and reliability patch: every embedded store now persists to a durable SQLite .db file (migrating legacy JSON in place on first load), the dependency surface is refreshed, and several correctness edges in enforcement and server startup are hardened.

• SQLite persistence consolidation — case, agent-registry, session, and event stores now persist to per-store SQLite .db files with WAL journaling and transactions, replacing the previous JSON snapshots; existing JSON state is migrated automatically on first load.
• Enforcement correctness — the Windows process-signal path issues a real taskkill /F /PID for KILL and returns honest errors for unsupported STOP/CONT instead of reporting a fake success.
• Server startup hardening — the listener bind path removes a TOCTOU race by keeping the bound socket instead of binding, dropping, and rebinding.
• Dependency and CI refresh — rusqlite 0.40, tower-http 0.7, and a batch of patch/minor bumps are applied; the container build tracks the pinned 1.95 toolchain and previously soft-failed CI gates now run as hard gates.

See CHANGELOG.md for full release history.

Quick Start

Install frontend dependencies and build the Rust binary:

npm ci --prefix admin-console
cargo build --release

Start Wardex:

./target/release/wardex start

Read the generated admin token:

cat var/.wardex_token

Open the console:

http://localhost:8080/admin/

Notes:

• http://localhost:8080/ serves the product website.
• http://localhost:8080/admin/ serves the authenticated admin console.
• If WARDEX_ADMIN_TOKEN is set, Wardex uses that token and may not create var/.wardex_token.
• Check the running version with ./target/release/wardex --version.
• Export machine-readable diagnostics with ./target/release/wardex doctor --json.

Useful local commands:

cargo run -- demo
cargo run -- analyze examples/credential_storm.csv
cargo run
WARDEX_ADMIN_TOKEN="$(cat var/.wardex_token)" bash scripts/evaluate_to_value.sh

The evaluation script exercises the 15-minute path with evaluation-only seeded proof data: readiness, first-run proof seeding, first alert, response dry-run, evidence export, and deployment trust reporting. The exported artifacts land in output/evaluate-to-value/.

Core Capabilities

• Telemetry and monitoring: OS event streams, process trees, file/network activity, kernel-event normalization, and live control-plane views.
• Detection engineering: managed Sigma/native rules, YARA content, MITRE ATT&CK coverage, suppressions, replay validation, promotion/rollback, and saved hunts.
• Malware analysis: hash and YARA matching, static and behavior profiles, quarantine guidance, open-source signature presets, and on-demand scans.
• SOC workflows: alert queue, cases, investigations, notes, timelines, evidence bundles, handoffs, response approvals, and analyst assistant pivots.
• Response automation: playbooks, approval gates, platform-aware remediation actions, rollback evidence, and audit history.
• Fleet operations: agent enrollment, heartbeat tracking, policy sync, rollout assignment, rollback, recovery focus, and inventory context.
• Governance: RBAC, HttpOnly admin sessions, audit chain, retention controls, encrypted evidence buffering, compliance exports, and support bundles.
• Integrations: SIEM export, OCSF normalization, live threat-intel feed ingestion (MalwareBazaar, URLhaus, Feodo Tracker), ticket sync, OpenTelemetry, GraphQL, REST OpenAPI, and generated SDKs.

Documentation

Start here:

• Getting Started
• Evaluate Wardex in 15 Minutes
• Architecture
• Status
• Compatibility
• Release Acceptance
• Runbooks
• Operate Wardex
• Install/Upgrade
• Troubleshoot
• SDK Guide
• OpenAPI Contract

The public website lives in site/ and mirrors the main product, release, and support information.

Documentation Surfaces

The GitHub docs and the public website now share the same v1.0.30 release surface for operator guides and API reference.

Development and Verification

Common checks:

cargo test
cargo build --release
make smoke
npm run build --prefix admin-console
python3 scripts/validate_release_docs.py
make release-acceptance

Focused frontend checks can be run from admin-console/ with Vitest or Playwright, depending on the workflow being changed.

Releases and Trust

Tagged releases are packaged by GitHub Actions for Linux, macOS, and Windows. The release pipeline publishes checksums, CycloneDX SBOMs, SLSA provenance, cosign signatures, and notarized macOS archives when the required signing secrets are present.

Local signed macOS builds require Developer ID signing and notarization credentials. Unsigned local builds are still useful for development and verification, but tagged CI releases are the distribution path for signed artifacts.

Repository Layout

src/                  Rust control plane, detection, scanning, response, and API modules
admin-console/        React admin console embedded into release builds
site/                 Static product website
docs/                 Product docs, runbooks, status, architecture, and release guidance
sdk/                  Generated Python and TypeScript SDKs
deploy/               Helm, OTLP, container, signing, and deployment assets
tests/                Integration, live, and browser smoke coverage
examples/             Sample telemetry and demo scenarios
.github/workflows/    CI, Pages, release, signing, and publishing automation

License and Support

Wardex is dual-licensed:

• Open source: AGPL-3.0
• Commercial: commercial license for organizations that cannot use AGPL network-service copyleft terms

Support details are available on the Wardex support page and through GitHub Sponsors.

For production deployment, licensing, or operator support, contact support@wardex.dev. For responsible security disclosure, email security@wardex.dev or use the private GitHub advisory flow.