Stop Building Plumbing.
Start Building Detection.

Drop a production-ready Windows kernel telemetry layer into your security product and start receiving real-time endpoint events today — without building drivers, debugging pool leaks, or losing engineers to kernel plumbing.

Kernel Telemetry Is Brutally Hard

Before you can write your first detection rule, train your first model, or ship your first demo, someone has to solve Windows kernel telemetry. That means:

• A minifilter driver for file system events — creates, writes, renames, deletes
• A WFP callout driver for network flows, DNS, and TLS metadata
• Kernel notification callbacks for process start/exit, image load, thread creation, and registry writes
• Handle acquisition monitoring via ObRegisterCallbacks — the only way to see OpenProcess calls
• A high-throughput, crash-safe channel from kernel space to your user-mode agent
• ETW consumer integration for authentication, WMI, AMSI, and scheduled task events
• An IRQL-aware, pool-leak-free implementation that survives Patch Tuesday

What Heathen Gives You

Heathen replaces 3–5 years of kernel engineering with a single integration.

Link against the SDK, implement a single C++ interface, and your agent starts receiving normalized, structured security events from the Windows kernel — in real time, on both x64 and ARM64.

Your engineers work on the problems that grow your business. We work on the problems that would have stopped you before you started.

Three Steps to Your First Event

Integration takes under a day for a working prototype. Most of that time is driver installation, not code.

// Full integration example — this is not pseudocode.
HeathenEventCallbacks cbs{};

cbs.onProcess = [](const EventHeader* hdr, void* ctx) {
    if (hdr->EventType == EVENT_PROCESS_START) {
        auto* e = static_cast<const ProcessStartEvent*>(hdr);
        // image path, command line, parent PID, user SID — all here
    }
};
cbs.onFile    = [](const EventHeader* hdr, void* ctx) { /* ... */ };
cbs.onHandle  = [](const EventHeader* hdr, void* ctx) { /* ... */ };
cbs.onNetwork = [](const EventHeader* hdr, void* ctx) { /* ... */ };

HEATHEN_RING* ring = HeathenRingCreate(16 << 20);
HeathenRingConsumeAndDispatch(ring, cbs);  // blocks; returns on each kernel signal

Everything That Matters on a Windows Endpoint

Seven MITRE ATT&CK Rules, Ready to Use

Heathen ships an optional static detection library with seven baseline rules. Pure library — no threads, no I/O, no global state — callable directly from any event callback.

These are starting points, not a finished product. Your detection capability is your moat — Heathen gives you the foundation, not the ceiling.

The Cost of Building It Yourself

We understand the instinct. Kernel code that ships in your product feels better when your team wrote it. Here is what that actually costs:

How This Works

Get the Dev Kit

Fill out the form below. You’ll get the dev kit download and a no-distribution license within one business day — reviewed personally, not by a bot. Prefer to ask questions first? Email the developer directly →