Platform Research: What should NativeRelay use on each OS?

[VeloraTech]

NativeRelay is intended to provide a common interface over native operating-system telemetry.

The current direction is:

Platform | Current direction -- | -- Linux | fanotify / native telemetry Windows | ETW research macOS | Endpoint Security research

Linux is the initial reference implementation.

The reason is not that Linux should be treated as the "standard" platform. It is simply a practical place to establish the event model and collector architecture using strong low-level observability primitives.

The difficult part comes when we try to provide equivalent functionality across operating systems.

For example, NativeRelay may eventually want to expose events such as:

ProcessStarted
ProcessExited
FileOpened

FileCreated

FileModified

FileDeleted

FileRenamed
NetworkConnectionStarted

NetworkConnectionClosed

But the native mechanisms behind those events are fundamentally different.

What we're researching

Linux

Current focus:

• fanotify

• process attribution

• file access events

• permission requirements

• queue overflow / event loss

• behavior in containers and restricted environments

Windows

Current research direction:

• ETW

• File I/O providers

• process attribution

• event correlation

• permissions

• event ordering

• reliability

macOS

Current research direction:

• Endpoint Security

• process events

• file events

• entitlements

• permissions

• deployment requirements

• event ordering and reliability

What we'd like from contributors

If you have experience with one of these platforms, we'd like to know:

• Which native APIs would you choose?

• What important limitations should we account for?

• Which events are actually reliable?

• What permissions are required?

• What assumptions do developers commonly get wrong?

• Are there better primitives we should investigate?

If possible, please distinguish between:

Documented capability

Observed behavior

Inference

NativeRelay is specifically trying to avoid building an abstraction that looks portable while quietly providing very different guarantees on each platform.

Platform research is therefore a first-class contribution.

If you have deep knowledge of Linux, Windows, macOS, or systems observability, this is a good place to challenge the current direction.