Project Structure

exfil-guardian/
├── driver/              # Rust #![no_std] WDM kernel driver (Ring 0)
├── agent/               # Rust Windows service (Ring 3)
├── server/              # Rust gRPC + REST server
├── analysis/            # Rust detection & correlation library
├── installer/           # Rust Windows installer
├── proto/               # Protobuf service definitions
├── certs/               # Rust mTLS certificate generator
├── signatures/          # YAML detection rules (hot-reload)
├── desktop/             # Electron + Next.js dashboard
├── docs-site/           # Fumadocs documentation site
├── Cargo.toml           # Rust workspace root
├── nx.json              # Nx monorepo orchestration config
├── config.yaml          # Runtime configuration (server + analysis)
└── package.json         # Root scripts (thin Nx wrappers)

driver/
├── Cargo.toml              # no_std, windows-kernel dependencies
├── build.rs                # WDK build integration
├── exfil_guardian.inx       # Driver INF file (install manifest)
├── makefile.toml            # cargo-make tasks
├── rust-toolchain.toml      # Pinned nightly toolchain
└── src/
    ├── lib.rs               # DriverEntry, DriverUnload
    ├── device/
    │   ├── mod.rs
    │   ├── core.rs          # Device object create/close
    │   └── io.rs            # IRP_MJ_DEVICE_CONTROL handler
    ├── security/
    │   ├── mod.rs
    │   ├── filter.rs        # WFP callout registration + packet capture
    │   ├── wfp.rs           # WFP API bindings
    │   ├── wfp_wrapper.h    # C header for WFP types
    │   ├── process.rs       # ObRegisterCallbacks (anti-kill)
    │   └── registry.rs      # CmRegisterCallbackEx (registry protection)
    └── utils/
        ├── mod.rs
        └── string.rs        # Kernel-safe string utilities

agent/
├── Cargo.toml
├── build.rs                 # Protobuf code generation
├── project.json             # Nx targets (build, test, lint)
└── src/
    └── main.rs              # Service entry, driver comms, gRPC client

server/
├── Cargo.toml
├── build.rs                 # Protobuf code generation
├── project.json             # Nx targets (build, dev, test, lint)
├── static/                  # Static assets for web UI
└── src/
    ├── main.rs              # Server entry (Tonic + Axum + config loading)
    ├── grpc/
    │   ├── mod.rs
    │   └── receiver.rs      # StreamPackets RPC (routes to ServerPipeline)
    ├── core/
    │   ├── mod.rs
    │   ├── bridge.rs        # gRPC NetworkPacket → analysis PacketMetadata
    │   ├── config.rs        # ServerConfig (YAML loading with defaults)
    │   └── pipeline.rs      # ServerPipeline (FlowTracker + AnalysisPipeline)
    └── api/
        ├── mod.rs
        ├── routes.rs        # Axum route definitions
        ├── enroll.rs        # Agent enrollment endpoint
        └── alerts.rs        # Alert list + pipeline metrics endpoints

analysis/
├── Cargo.toml
├── project.json             # Nx targets (build, test, lint)
└── src/
    ├── lib.rs               # Crate root, public API
    ├── config.rs            # Analysis configuration (agent + server)
    ├── error.rs             # Error types (thiserror)
    ├── types/
    │   ├── mod.rs
    │   ├── packet.rs        # PacketMetadata
    │   ├── flow.rs          # FlowRecord
    │   ├── detection.rs     # Detection event
    │   ├── alert.rs         # Alert (scored, correlated)
    │   ├── dns.rs           # DNS-specific types
    │   └── tls.rs           # TLS-specific types
    ├── agent/               # Runs on the endpoint
    │   ├── mod.rs
    │   ├── flow_tracker.rs  # Flow aggregation
    │   ├── dns_extractor.rs # DNS metadata extraction
    │   ├── tls_extractor.rs # TLS metadata extraction
    │   └── pre_filter.rs    # 8-heuristic pre-filter
    └── server/              # Runs on the server
        ├── mod.rs
        ├── pipeline.rs      # Detection pipeline runner
        ├── dpi/
        │   ├── mod.rs
        │   ├── dns_analyzer.rs   # DNS entropy, DGA, tunneling
        │   ├── tls_analyzer.rs   # JA3, cert anomalies, SNI
        │   └── icmp_analyzer.rs  # Covert channel detection
        ├── signatures/
        │   ├── mod.rs
        │   ├── rule.rs           # DetectionRule struct
        │   ├── condition.rs      # Condition evaluator
        │   ├── engine.rs         # Signature matching engine
        │   └── loader.rs         # YAML hot-reload watcher
        ├── behavioral/
        │   ├── mod.rs
        │   ├── baseline.rs       # Welford's online algorithm
        │   ├── anomaly.rs        # Z-score, CUSUM, EMA
        │   ├── beaconing.rs      # CV-based beacon detection
        │   └── volume.rs         # Transfer volume tracking
        └── correlation/
            ├── mod.rs
            ├── engine.rs         # Correlation orchestrator
            ├── scorer.rs         # Bayesian confidence scoring
            └── temporal.rs       # Temporal window + decay

proto/
└── exfil.proto              # ExfilService + NetworkPacket definition

certs/
├── Cargo.toml
├── project.json             # Nx targets (build)
├── generate_certs.ps1       # PowerShell wrapper for cert generation
└── src/
    └── main.rs              # rcgen-based CA, server, agent cert generator

installer/
├── Cargo.toml
├── project.json             # Nx targets (build)
└── src/
    └── main.rs              # Windows registry + service creation

signatures/
├── dns/
│   ├── dga.yaml             # Domain Generation Algorithm rules
│   ├── exfiltration.yaml    # DNS exfiltration patterns
│   └── tunneling.yaml       # DNS tunneling indicators
├── http/
│   ├── suspicious_headers.yaml
│   └── upload_exfil.yaml
└── tls/
    └── suspicious_cert.yaml

desktop/
├── package.json
├── project.json             # Nx targets (dev, build, lint, dist)
├── electron-builder.yml      # Build/packaging configuration
├── electron/
│   ├── main.ts               # Electron main process
│   ├── preload.ts            # contextBridge API
│   ├── tsconfig.json
│   ├── ipc/
│   │   ├── index.ts          # IPC handler registry
│   │   ├── threats.ts        # Threat data handlers
│   │   ├── capture.ts        # Capture control handlers
│   │   └── config.ts         # Configuration handlers
│   ├── backend/
│   │   ├── index.ts          # Backend API client
│   │   └── websocket.ts      # WebSocket connection
│   └── utils/
│       ├── config.ts         # App configuration
│       └── logger.ts         # Logging utility
└── src/
    ├── app/                  # Next.js App Router pages
    │   ├── layout.tsx
    │   ├── page.tsx
    │   ├── dashboard/page.tsx
    │   ├── threats/page.tsx
    │   ├── threats/[id]/page.tsx
    │   ├── capture/page.tsx
    │   ├── analysis/page.tsx
    │   └── settings/page.tsx
    ├── components/
    │   ├── layout/           # App shell (Header, Sidebar, Footer)
    │   ├── dashboard/        # Stats cards, traffic charts
    │   ├── threats/          # Threat list, detail views
    │   ├── capture/          # Capture controls, packet stats
    │   ├── analysis/         # Behavioral stats, correlation graph
    │   ├── common/           # Shared components
    │   └── ui/               # Base UI primitives
    ├── hooks/                # React hooks (use-threats, use-capture, etc.)
    ├── lib/
    │   ├── api/              # API client functions
    │   ├── store/            # Zustand state stores
    │   ├── types/            # TypeScript type definitions
    │   ├── mock/             # Mock data generators (dev)
    │   └── utils/            # Formatting, helpers, validators
    └── config/
        └── site.ts           # Site metadata

docs-site/
├── content/docs/            # MDX documentation pages
├── project.json             # Nx targets (dev, build)
├── source.config.ts         # Fumadocs source configuration
├── next.config.mjs          # Next.js config
└── package.json