ONE SHIELD — MULTI-AGENT + FIREWALL MONITOR (v0.1 ENGINEERING PREVIEW)
2026-10-12 | MCHILS EBX

PRODUCT SCOPE
ONE Shield is a separate security-management edition for Windows endpoints.
This proof-of-concept implements four coordinated, READ-ONLY monitoring agents:
1. Antivirus Agent — reports Windows Defender protection, anti-spyware, tamper status,
   signature age and recent scan ages.
2. Firewall Shield Agent — reports Windows Defender Firewall Domain/Private/Public
   profiles and default inbound/outbound policies; warns if a profile is disabled.
3. System Health Agent — reports Windows version and uptime.
4. Update Health Agent — reports Windows Update service state only.

DESIGN
- One executable with independent modular collectors. Avoids installing four
  competing background services or antivirus scanning engines.
- The executable runs once when manually invoked; no autostart, kernel drivers,
  persistence, remote terminal, firewall modifications or file inspection.
- Collectors call only predefined, read-only Windows PowerShell cmdlets.
- No ExecutionPolicy Bypass option. Enterprise policies may block some reads.
- No telemetry, network upload or vendor cloud connections are implemented.
- Output is local JSON intended for a future opt-in client dashboard.

RUNNING (AUTHORIZED ENGINEERING LABS ONLY)
  ONE-Shield-Monitor-v0.1-Windows-x64.exe -list-agents
  ONE-Shield-Monitor-v0.1-Windows-x64.exe -modules firewall
  ONE-Shield-Monitor-v0.1-Windows-x64.exe -modules antivirus,firewall
  ONE-Shield-Monitor-v0.1-Windows-x64.exe
Results appear in stdout as JSON. Output may contain security posture information;
do not share it publicly. Do not test on production customer endpoints.

CURRENT LIMITATIONS
- Unsigned, not independently audited, and not validated through a full runtime
  execution on a Windows endpoint in this release.
- Not an antivirus, anti-malware detection engine, spyware cleaner, ransomware
  blocker, packet-filtering firewall, EDR, or replacement for Defender.
- Does not call a commercial Defender endpoint-management API, collect threat
  alerts continuously, run scans, or change Windows Firewall settings.
- No customer multi-tenancy/cloud reporting wired to this collector yet.
- Windows 10/11 with appropriate management permissions is targeted.

SECURITY DESIGN FOR FUTURE VERSION
- Endpoint agent signs device identity and authenticates to a tenant-scoped broker.
- Client admin can apply signed policy only to authorized devices, with MFA and audit.
- Firewall rule changes must be explicitly approved, rollback-supported and
  protect management connectivity.
- Anti-malware scanning/remediation should invoke supported Windows security
  engines; do not install multiple active antivirus engines that compete.
- Advanced EDR/IDS, phishing defense and application control are distinct later
  milestones requiring testing, data-handling controls and licensing.

VERIFICATION PERFORMED
- Go build Windows x64: PASS.
- Go vet: PASS.
- Go tests with race detector: PASS.
- Windows runtime of this new executable: NOT VERIFIED (execution check blocked).
- Windows Defender/Firewall read-only cmdlets: confirmed available in earlier
  separate checks, but not proof of this executable's runtime behavior.

Visit product roadmap: https://one-desk.72.61.93.56.nip.io/shield/
Contact: info@mchilsconsultancy.com

(C) 2026 MCHILS EBX. Private engineering research. Not a commercial product.
