Architecture Overview
UEC is a multi-service control plane with durable agents on endpoints.
UEC is a multi-service control plane with durable agents on endpoints. The console is a Next.js application; the API and policy engine are ASP.NET Core; PostgreSQL stores authoritative domain state; NATS JetStream carries asynchronous event transport; ClickHouse stores high-volume event analytics; Redis supports cache and SignalR helpers.
Reading the system left to right
Section titled “Reading the system left to right”- An administrator signs in. UecWeb authenticates against Uec.Api and receives a JWT session. Local, Entra ID, OIDC and MFA flows are supported according to tenant identity settings.
- Policy intent is authored in the console. The API stores typed rules and policy metadata in PostgreSQL. XML and CIP artifacts are compiled server-side.
- Agents enrol. A device presents a signed enrollment token, is registered, and receives its own credential. Later REST and SignalR calls use agent JWTs.
- Policy resolution happens server-side. UEC resolves the device’s one base group, supplemental groups and effective mode, then emits the target artifact set.
- Agents download artifacts. A base version has paired audit and enforce artifacts. The agent selects according to the heartbeat’s effective mode.
- Endpoints enforce and observe. Windows applies WDAC, macOS applies its native security workflow, and Linux uses its tiered eBPF/IMA/fanotify enforcement stack.
- Events are buffered locally. Agents persist events before transmission and delete them only after the server acknowledges the batch.
- Events stream through the bus. Compressed batches enter the ingestion pipeline and NATS JetStream; stream processors persist analytics to ClickHouse.
- The console queries the right store. PostgreSQL answers domain objects; ClickHouse answers high-volume event analytics.
- Operators detect and respond. Alerts, detection findings, UEBA risk, forensics and response actions use the same tenant and device identity.
Service topology
Section titled “Service topology”| Component | Technology | Responsibility |
|---|---|---|
| UecWeb | Next.js 16, React 19, TypeScript | Console, forms, lists, charts, real-time providers |
| Uec.Api | ASP.NET Core (.NET 10) | REST, SignalR hubs, authorization, policy orchestration, background jobs |
| Uec.PolicyEngine | .NET | Typed WDAC authoring and policy generation |
| Wdac.SiPolicyConverter | .NET | SiPolicy XML ↔ CIP binary conversion |
| Uec.Telemetry / Uec.NatsConsumer | .NET | Event parsing, forwarding and ingestion |
| Uec.Shipping* | .NET/Rust components | Durable local event shipping and scans |
| Uec.Fim / Uec.Forensics / Uec.Ueba | .NET | File integrity, forensic queries, behavior baselines |
| Uec.Sensor.Win | Rust and native sidecars | Windows enforcement, tray, update, watchdog, tamper guard |
| Uec.Sensor.Mac | Swift | macOS Endpoint Security, Gatekeeper and inventory workflows |
| Uec.Sensor.Linux | Rust/eBPF | Linux process/network monitoring and enforcement |
| PostgreSQL | 18.3 | Tenants, users, devices, policies, assignments, audit records |
| ClickHouse | 26.3 | Events, analytics tables and detection/UEBA baselines |
| NATS JetStream | 2.14 | Asynchronous event transport |
| Redis | 8.6 | Cache and SignalR scale-out helpers |
Real-time communication
Section titled “Real-time communication”
| Hub | Path | Direction | Purpose |
|---|---|---|---|
| AgentHub | /hubs/agent |
Console/API ↔ agent | Commands, heartbeat, policy notification, compressed event batches |
| EventHub | /hubs/events |
API → console | Device status, new alerts, action state and other tenant updates |
The notification bell is an operator inbox, not a debug stream. Its badge counts unread alerts plus waiting approvals; informational system rows are visible but do not inflate the count. When a hub disconnects, providers fall back to polling and the UI says that it is reconnecting rather than pretending to be live.
Policy data flow
Section titled “Policy data flow”
Authored state
Section titled “Authored state”Policy and PolicyVersion hold reusable intent and typed rules. A supplemental policy does not
persist a base binding; binding is late so the same trust can compile against the base a device
actually uses.
Resolved deployment intent
Section titled “Resolved deployment intent”The server combines group membership and device heartbeat metadata to resolve:
- the single effective BaseDeviceGroup;
- all contributing supplemental groups;
- the effective mode: Audit, Enforce or Disabled.
Final artifacts
Section titled “Final artifacts”- Each base version emits two artifacts: audit and enforce.
- Supplemental artifacts are merged per supplemental group and base context.
- Windows-required identifiers, including
PolicyID,BasePolicyIDandVersionEx, belong to the generated artifact layer. - The artifact feed is the only delivery path; there is no legacy per-policy XML fallback.
Event data flow
Section titled “Event data flow”
| Stage | Guarantee |
|---|---|
| Collect | Agent event channels are opt-in through Agent Configuration. |
| Buffer | Local durable storage survives process restart and server outage. |
| Ship | MessagePack plus Zstd batches are acknowledged before local deletion. |
| Ingest | The API or stream pipeline validates, classifies and publishes envelopes. |
| Persist | ClickHouse stores analytics data; PostgreSQL retains domain records. |
| Query | List pages use server-side filtering, pagination and truncation-aware exports. |
| Forward | SIEM/SOAR, webhook and alert-forwarder integrations hand off selected data. |
Security architecture
Section titled “Security architecture”
- Users and agents use JWT bearer credentials; SignalR passes a short-lived token.
- Enrollment tokens bootstrap the first device credential.
- Role and page permissions are evaluated server-side; hidden buttons are not the control.
- Local-password policy, MFA, SSO and conditional access are tenant-configurable.
- Sensitive settings can require password re-verification.
- API responses use hardened security headers and RFC 9457
ProblemDetailserror shapes. - Audit records capture actor, action, resource, result and field-level changes.
Deployment shapes
Section titled “Deployment shapes”UEC supports container-based deployment and can run behind a base path such as /xdr/uec. A
typical production topology places a load balancer in front of multiple API instances, with shared
PostgreSQL, ClickHouse, NATS and Redis services. Single-host and air-gapped guides exist for labs,
small sites and operational-technology networks.
Scale target: the architecture is designed for tens of thousands of managed endpoints with 99.9% availability. Actual capacity depends on event rate, retention, detection pack scope and database sizing.