Endpoint Watch

About the project

Endpoint Watch is a lightweight endpoint detection tool that monitors what's running on your machine and flags suspicious activity. It grew out of my interest in the security side of engineering.

It's the project where I stopped treating the OS as a black box, processes, persistence mechanisms, and the signals that separate normal from suspicious.

Highlights

• Process and activity monitoring on the host
• Rule-based flagging of suspicious behavior
• Built to learn detection engineering from first principles