Components

Five components, each a top-level directory of the one repository. Each documents itself; this section says what is in each one and how the pieces relate.

  • ProvCollector.Common

    Four shared libraries: the wire contract and Kafka transport, the EF Core model, host plumbing, and the graph engine.

  • ProvCollector.Agent

    The collection endpoint. Windows ETW sources, a Rust registry driver, and a Linux host skeleton.

  • ProvCollector.Backend

    The two services between the agents and the database: event processor and PostgreSQL writer.

  • ProvCollector.Analysis

    Read-side tooling: the Tracker CLI, the Visualizer, the ThroughputMonitor and the BotReporter.

  • ProvCollector.Management

    The fleet plane: updater, fleet server, operator dashboard, and the Windows and Linux installers.

How they depend on each other

Components depend on one another through ordinary ProjectReferences, so a change to a shared library is picked up by the next build of anything that uses it.

Component Depends on Produces
ProvCollector.Common — Four shared libraries
ProvCollector.Agent Common Agent binaries, the registry driver
ProvCollector.Backend Common EventProcessor, Postgres writer
ProvCollector.Analysis Common; Backend (the Tracker.Common tests use the writer) Tracker, Visualizer, ThroughputMonitor, BotReporter
ProvCollector.Management Common; Agent (the installers package agent binaries) Updater, FleetServer, Dashboard, installers

Project naming

Within each component directory, every project sits directly at that directory’s root — there is no Tools/ grouping layer. A project’s directory name is its assembly name, and its path is predictable from either. Each component also has its own solution for working on it alone.

Targets

Every C# project targets net10.0, except ProvCollector.Agent.Windows, which targets net10.0-windows. The registry driver is Rust against the WDK; the Linux installers are Rust; the Windows installers are WiX v6.


Table of contents


Back to top

ProvCollector — system-provenance collection, storage and analysis. Documentation built with Jekyll and Just the Docs.