Design Endpoint Detection - System Design | WinJob

Problem Statement and EDR Mission

Enterprise EDR at CrowdStrike-class scale ingests 9.8M peak events/sec from 5.2M managed endpoints. This section focuses on kernel telemetry and user-mode sensor fusion: how sensors, stream processors, and analysts experience the same truth without overloading laptops or SOC triage queues.

Design anchors (1)

Anchor 1a: kernel telemetry and user-mode sensor fusion must stay tamper-evident—agents verify policy signatures before applying kernel hooks.
Anchor 1b: Separate collection throughput from detection latency; SOC measures MTTD on correlated alerts, not raw EPS.
Anchor 1c: Idempotency keys on enrollment and response APIs prevent storm retries from amplifying incidents.

Mechanism detail

Agents batch telemetry with bounded memory, encrypt on disk, and upload over mutual TLS. The cloud pipeline normalizes events to a canonical schema (process, file, network, registry) and attaches tenant, policy, and MITRE tags before rule evaluation. Detection combines deterministic Sigma-style rules with streaming baselines; high-severity hits open incidents with pre-built response playbooks (isolate host, kill process tree, quarantine file).

Failure drills

If Managed endpoints stalls >45s, shed non-essential enrichments (GeoIP, asset tags) while preserving process-create events.
When Peak EPS exceeds plan, scale ingest consumers ahead of Flink job restarts to avoid duplicate alert storms.
Agent-side queues above 50MB trigger local spill-to-disk; cloud path replays with cursor host_id:seq once mTLS returns.
Policy promotion failures keep prior policy_generation and page SecOps—never push unsigned detection content.

Cost and capacity

At 9.8M Peak EPS, partition Kafka by tenant_id + event_category and cap per-host EPS to protect shared Flink state.

Signal	Target
Managed endpoints	5.2M
Peak EPS	9.8M
Detection p95	42s
Tenants	1.4K

javaOne Dark Pro

1 public final class PolicyBundle {
2   private final int generation;
3   private final byte[] signature;
4   public boolean verify(PublicKey key) { /* Ed25519 verify */ return true; }
5 }

pythonOne Dark Pro

1 def merge_alert(existing: dict, incoming: dict, window_sec: int = 900) -> dict:
2     if existing["technique"] == incoming["technique"]:
3         existing["count"] += 1
4     return existing

typescriptOne Dark Pro

1 export type AgentCursor = { hostId: string; seq: number };
2  
3 export function nextCursor(cursor: AgentCursor, batchSize: number): AgentCursor {
4   return { hostId: cursor.hostId, seq: cursor.seq + batchSize };
5 }

Why interviewers care

Endpoint Detection interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and EDR Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Problem Statement and EDR Mission
•Metrics: Managed endpoints, Peak EPS, Detection p95
•Focus: kernel telemetry and user-mode sensor fusion

1	public final class PolicyBundle {
2	private final int generation;
3	private final byte[] signature;
4	public boolean verify(PublicKey key) { /* Ed25519 verify */ return true; }
5	}

1	def merge_alert(existing: dict, incoming: dict, window_sec: int = 900) -> dict:
2	if existing["technique"] == incoming["technique"]:
3	existing["count"] += 1
4	return existing

1	export type AgentCursor = { hostId: string; seq: number };
2
3	export function nextCursor(cursor: AgentCursor, batchSize: number): AgentCursor {
4	return { hostId: cursor.hostId, seq: cursor.seq + batchSize };
5	}