Endpoint Telemetry • Asset Intelligence • Infrastructure Visibility • Risk Correlation
A multi-tenant telemetry platform for endpoint visibility and infrastructure intelligence.
5
OS Platforms Covered
4
Architecture Layers
8
Data Flow Steps
5
Analysis Engines
I designed and built a customer-facing telemetry platform intended to continuously collect endpoint and infrastructure-adjacent data, convert it into operational and security-relevant intelligence, and expose it through dashboards, alerts, and remediation-oriented visibility for customer environments.
At its core, the platform solved a visibility problem most enterprise teams quietly live with: no unified way to continuously understand endpoint state, asset liveness, configuration drift, hardening gaps, and infrastructure health across distributed environments. Devices stop reporting. Unmanaged assets disappear. Software versions age into risk. Teams only discover the problem after something has already gone wrong.
This is the most complete example of the kind of work I enjoy — systems that sit at the intersection of endpoint operations, telemetry engineering, infrastructure visibility, automation, and security intelligence.
The Problem
Fragmented visibility across everything
Fragmented Endpoint Visibility
Teams had asset inventories, patching scripts, and ad hoc monitoring, but no single operational layer that answered: which endpoints are alive, which have gone stale, which devices show hardening gaps.
Infrastructure Blind Spots
Routers, switches, and firewalls could not run a direct agent. They either stayed outside visibility entirely or were tracked through inconsistent log forwarding and manual review.
Weak Risk Linkage
Even when telemetry existed, teams lacked a structured way to connect it with CERT-In advisories, hardening posture, stale-device risk, or remediation workflow visibility.
No Customer Operational Layer
Internal teams had backend visibility but customers themselves had no clean portal showing asset liveness, endpoint health, risk indicators, or devices needing follow-up.
Technical Objectives
Interactive Flow
End-to-End Telemetry Data Flow
From endpoint signal to customer action — 8 steps, animated. Click dots to jump.
Endpoint & Infra Collection
Win • Linux • macOS • Android • Forwarders
Secure Transmission
Certificate-backed trust model
Telemetry Ingestion Gateway
Python WSGI service — central intake point
In-Memory Telemetry Buffer
Decouples collection from DB write pressure
MySQL Telemetry Persistence
Multi-tenant structured storage
Intelligence Analysis Engine
Liveness • Inventory • CERT-In • Posture • AI
Alerts & Dashboard Layer
Customer & internal visibility surfaces
Remote Operational Response
Targeted action workflows
Platform Architecture
Network Architecture Layers
Five distinct layers, each with a clear role in the pipeline.
Collection Layer
Ingestion Layer
Storage Layer
Analysis Layer
Output Layer
Components
The Four Platform Components
01
Cross-Platform Endpoint Agents
A Golang-based native Windows agent (small, no heavy runtime), RHEL and Debian-aware Linux packages, a macOS collector, and an Android APK. Each captures: device identity, OS/software inventory, health state, hardening observations, and liveness signals.
02
Infrastructure Forwarder Layer
A Windows or Linux host runs a forwarder component that doubles as its own endpoint collector and as a relay for non-agent infrastructure devices — routers, firewalls, switches — whose data would otherwise be invisible to the platform.
03
Ingestion, Buffer & Persistence
A Python WSGI backend authenticates agents, parses payloads, tags tenants, and stages telemetry in an in-memory buffer before batch-flushing to MySQL. This decouples collection frequency from direct DB write pressure, keeping ingestion practical at scale.
04
Analysis, Intelligence & Visibility
Five analysis sub-engines evaluate liveness, correlate inventory with CERT-In advisories, assess posture, and run AI-assisted org-level reasoning. Results surface through customer dashboards, manager consoles, stale-asset alerts, and remote response triggers.
Technical Depth
Engineering Decisions That Mattered
Buffered Ingestion Design
Not writing every heartbeat directly to DB
- Telemetry staged in in-memory collector, not immediately persisted row-by-row
- Periodic batch write process flushes structured data to MySQL
- Reduces write amplification; decouples collection frequency from DB pressure
- Creates a clean normalization opportunity before persistence
CERT-In Advisory Correlation
Moving from 'collect data' to 'interpret risk'
- Platform maintains advisory intelligence from CERT-In alongside endpoint telemetry
- Analysis layer compares OS/software state against advisory-relevant conditions
- '500 endpoints exist' becomes '37 need attention due to advisory overlap'
- Advisory-linked risk raised to customer dashboards and alert surfaces
Stale Asset & Liveness Engine
Highlighting what's missing, not just what's visible
- Continuously evaluates whether endpoint is reporting within expected windows
- Stale flags distinguish: powered off, agent failed, decommissioned, asset lost
- Prevents invisible risk where only healthy devices appear in dashboards
- Liveness data feeds alert generation and customer follow-up workflows
AI-Assisted Reasoning Layer
Analysis augmentation, not magic
- Local model-driven workflows summarize tenant-level risk patterns
- Interprets clusters of stale / unhealthy endpoints for org-level visibility
- Provides higher-level reasoning around telemetry anomalies
- Not a replacement for deterministic rules — an augmentation layer on top
Multi-Tenant Architecture
One backend, multiple customers
- Single backend instance supports multiple customers with logical separation
- Tenant identity enforced at ingestion, storage, dashboard, and alert layers
- Role-scoped access: customer login, manager login, internal operator views
- Designed as a service/product model, not a one-off single-tenant stack
Platform Capabilities at a Glance
Endpoint Coverage
- Windows (Golang agent)
- RHEL / Debian packages
- macOS collector
- Android APK
- Infra forwarder relay
Telemetry Intelligence
- Asset inventory tracking
- Software version correlation
- Endpoint liveness detection
- Stale asset flagging
- CERT-In advisory mapping
- AI-assisted risk reasoning
Customer Operations
- Tenant-scoped dashboards
- Customer & manager login
- Issue / remediation follow-up
- Stale & risk alerts
- Remote control workflows
Platform Architecture
- Multi-tenant backend
- Python WSGI service
- In-memory telemetry buffer
- MySQL persistence layer
- Certificate-backed trust
Final Takeaway
This platform is the strongest representation of how I approach engineering problems. The challenge was never just collecting data — it was deciding what to collect, moving it safely, buffering it efficiently, correlating it with real-world risk context, and exposing it in a way that actually changes what teams do next.
Endpoint telemetry → structured intelligence → customer-facing operational visibility → action.
Build systems like this together