Course Announcement: Build a Production-Grade EDR/XDR From Scratch (21-Issue Hands-On Security Engineering Course)
Build a Production-Grade EDR/XDR From Scratch
A 21-issue engineering course on how modern security platforms are actually built — one layer at a time.
If you’ve ever wondered what’s really happening inside tools like CrowdStrike, SentinelOne, or Elastic Security when they detect an attacker on a laptop, this course is for you. Over 21 newsletter issues, we build a working — if intentionally simplified — EDR/XDR system from the ground up, so you understand the engineering, not just the marketing.
What EDR Actually Means
EDR (Endpoint Detection and Response) is software that watches a single machine closely: what processes start, what files get written, what network connections open. Think of it as a very attentive security camera pointed at one computer.
What XDR Actually Means
XDR (Extended Detection and Response) takes that idea further — it connects clues from many sources (different hosts, user identities, containers) into a single incident story. Instead of “curl ran on laptop-01,” XDR asks: “does this connect to that weird login and that unusual outbound connection on another host?”
What You’ll Actually Build
You’ll build a layered pipeline that mirrors how real EDR/XDR platforms are structured:
Agents for Linux, Windows, macOS, and Kubernetes that observe activity on a host
A common event format (OCSF) that normalizes what each OS reports into one shared language
A secure transport layer that buffers events and ships them with mutual TLS
An ingest and storage pipeline that queues and persists events
Detection rules (Sigma-as-code) and behavioral scoring that flag suspicious patterns
Correlation logic that stitches related alerts into a single incident (the “X” in XDR)
A SOC dashboard and an AI copilot that help an analyst investigate
A response layer that can take action — but only with explicit approval
The Architecture, In Plain Terms
Agents (Linux/Windows/macOS/K8s)
↓ (convert to OCSF JSON)
Secure transport (buffer + mTLS)
↓
Ingest → broker → storage
↓
Detections → correlation
↓
Dashboard / AI copilot → response (approved actions only)Each arrow in that diagram is its own set of issues in the course.
The Technologies You’ll Work With
eBPF (via Aya) for the Linux agent, ETW for Windows, and an Endpoint Security scaffold for macOS
OCSF (Open Cybersecurity Schema Framework) — the shared event schema, verified against the real 1.8.0 spec — so a process launch on Linux and one on Windows look the same to the backend
mTLS and SQLite-based buffering in the transport layer, so events aren’t lost if the network drops
Kafka-style broker → ClickHouse/SQLite pipeline for ingest and storage
Sigma-as-code detection rules plus a behavioral scoring engine and identity-based detection (ITDR) for things like impossible-travel logins
A correlation engine that links host, user, IP, and file-hash signals into one incident
A control-plane response system (kill process, quarantine file, isolate host) that is deliberately separated from the data plane and requires an explicit
--approvedflag — no silent auto-isolationA SOC dashboard and an AI copilot with constrained tools and red-team testing built in
A Helm chart for packaging the stack
What Makes This Different
Most security courses either stay theoretical or hand you a black-box product to click around in. This course does neither:
You build every layer yourself, from raw kernel events to the final incident view.
Labs run on replay fixtures (recorded event files) rather than requiring live kernel access on your machine, so you can follow along without special hardware or risky live hooking.
Design decisions are documented, including the ADR that separates “seeing” (data plane) from “acting” (control plane) — a real architectural principle used in production security systems.
Detection is taught as a conversion story, not a magic black box — you’ll see exactly how a raw event becomes an OCSF record becomes a matched rule becomes a correlated incident.
How the 21 Issues Progress
The course moves in a deliberate build order, roughly following the attack lifecycle a real analyst deals with:
Foundations — threat model and the OCSF schema you’ll normalize everything into
Agents — Linux (eBPF), Windows (ETW), and macOS, one platform at a time
Transport and pipeline — buffering, mTLS, and getting events into storage (Kafka → ClickHouse)
Telemetry depth — file, network, and persistence events, plus Kubernetes/container support
Detection — Sigma-as-code rules and behavioral detection
XDR correlation and identity — stitching alerts into incidents, including identity-based detection
Response — approved, auditable actions like isolating a host
Dashboard and AI copilot — the analyst-facing layer, including red-team testing of the copilot itself
Hardening and capstone — anti-tamper concepts, packaging with Helm, and a final coverage report
Each issue corresponds to a specific git tag in the companion repo, so you can check out exactly the working state that issue describes and follow along in real code.
An Honest Note
This is a demoable vertical slice, not a commercial product. It is not a claim that these labs produce a shipping fleet agent equivalent to CrowdStrike, SentinelOne, or Elastic. Most demos run against replay fixtures rather than live kernel hooks, and the goal is to teach you how these systems are layered and why, using honest labs and clearly scoped stubs — not to hand you an enterprise security platform.
Start Building
The full architecture only makes sense once you’ve laid the foundation. Issue 01 — Foundations, Threat Model, and OCSF is where it begins.
If you’ve ever wanted to understand security tooling from the inside out — not as a user, but as the engineer who built it — start there.