Overview
What it is
Sentova MTD is an anti-spyware / Mobile Threat Defense platform aimed at high-risk users. Its flagship "Device Defense" analyses iOS and Android forensic artifacts against a curated set of STIX 2.1 spyware indicators. It's built as a set of Go microservices (agents, assets, audit, billing, breach, brokers, gateway, iam, mtd, notifications) plus pnpm frontends.
The problem
Mercenary spyware (the Pegasus / Predator class) hides in forensic traces that are expensive to scan naively. Matching artifacts against raw STIX patterns at request time doesn't scale.
The architecture
The sentova-mtd service (its own sentova_mtd database, per the platform's
DB-per-service rule) stores STIX 2.1 indicator objects with a denormalized,
indexed observable array, so the artifact-match hot path is an index seek
rather than a STIX pattern parse. Indicators carry a malware-family label and a
shared low|medium|high|critical severity vocabulary; mercenary-spyware IOCs
default to critical.
Highlights
- Tenant isolation by construction — every account-facing document carries an
accountIdand every query filters on it, on top of gateway/PDP authorization. - Field-level encryption (AES-256-GCM) for sensitive artifacts, with encrypted fields never indexed.
- Verdicts and posture findings reuse the platform-wide severity ranking so they sort and render identically everywhere.