RoamSwitch Icon RoamSwitch by Lafine Systems Design

Capabilities

What RoamSwitch detects, how it stops threats and what it controls, grouped by what it protects.

Ransomware 4

Spots encryption activity, stops it, and gives you a way back to the state before the damage.

Feature What it does Action Default Products
Mass-encryption detection T1486 Watches writes and, when files with encrypted content pile up in a short time, cuts the network to stop the damage from spreading. ActionDetect Isolate DefaultOn with Pro Automatic response ProductsMac Linux
Detection with decoy files T1486 Places decoy files in important folders and alerts you when they are modified, deleted or encrypted. On Mac, it also cuts the network automatically. ActionDetect Isolate DefaultOn with Pro Notify only ProductsMac Linux Linux Server
Restoring files from before the damage Recovers files from before the damage, one by one, from snapshots taken at regular intervals. ActionControl Record DefaultOn Manual response ProductsMac Linux
Backup freshness check Checks whether the latest backup is recent and tells you when it is out of date. ActionAudit DefaultOn Notify only ProductsMac Linux Linux Server

Credential theft 5

Catches attempts to steal passwords, keys and tokens the moment they are read.

Feature What it does Action Default Products
Credential decoys T1552.001 Places decoy credentials (AWS, SSH keys, Docker and more) in the home folder and alerts you the moment they are read. The notification names the program, command and parent process. Real files are never overwritten. ActionDetect DefaultOn with Pro Notify only ProductsMac Linux Linux Server
Credential file read monitoring T1552.001 Alerts you when an unexpected program opens SSH private keys, AWS or gcloud credentials, passwords saved in browsers, AI agent sign-in data and similar files. ActionDetect DefaultOn Notify only ProductsLinux
Browser saved-data monitoring T1555.003 Alerts you when anything other than the browser opens the files that hold saved passwords and cookies in Chrome, Firefox and others. ActionDetect DefaultOpt-in Notify only ProductsMac
API key and private key detection T1204.004 Finds API keys and private keys in text, files, folders and the clipboard. Results are shown masked. ActionAudit DefaultOn Manual response ProductsMac Linux Linux Server
AI agent sign-in data check T1552.001 Checks the permissions and owner of the files where Claude Code, Codex and others store sign-in data, and whether they sit in a synced folder or under git. It never reads the contents. ActionAudit DefaultOn Notify only ProductsMac

Suspicious execution and malware 10

Traces the programs and command chains an attacker runs, and scans downloaded files.

Feature What it does Action Default Products
Process execution recording and attack-technique detection T1059.004 T1027 T1105 T1553.001 Records executed programs, arguments and parent-child relationships with tamper detection. Flags chains such as a shell launched from a browser, download-and-run, obfuscated execution and execution right after the quarantine attribute was removed. Secrets are masked. ActionDetect Record DefaultOpt-in Notify only ProductsMac Linux Linux Server
Sigma rule import Place your own Sigma rules (process creation) and they are applied to the execution record as additional detections. Rules that cannot be loaded are listed with the reason. ActionDetect DefaultOpt-in Notify only ProductsMac Linux Linux Server
Reverse shell detection T1059.004 Detects shells and interpreters whose input and output are tied to a connection to the outside, and alerts you. It also detects the command patterns themselves. ActionDetect DefaultOn with Pro Notify only ProductsMac Linux Linux Server
Malware scan right after download T1204.002 T1027 Scans downloaded files automatically and quarantines what it finds. Quarantined files can be restored or deleted permanently. ActionDetect Block DefaultOn Automatic response ProductsMac Linux
File content pattern matching Matches the contents of downloaded files against known patterns. On Linux this also happens when a file is written. ActionDetect DefaultOn Notify only ProductsMac Linux Linux Server
Integration with Apple's malware detection Cuts the network the moment XProtect actually detects malware. ActionIsolate DefaultOn with Pro Automatic response ProductsMac
ClickFix detection T1204.004 Finds attacks that trick users into pasting a command themselves through a fake verification screen, using shell history and the clipboard. ActionDetect Block DefaultOpt-in Automatic response ProductsMac Linux
Pre-execution blocking of dangerous programs Judges the threat at the moment of execution and denies execution of real threats. ActionBlock DefaultOn Automatic response ProductsLinux
Kernel-level intrusion detection and autonomous isolation T1562.006 Catches reverse shells, privilege escalation and execution of unauthorized binaries from kernel events. Freezes or kills processes and isolates the host within milliseconds. ActionDetect Isolate DefaultOn Automatic response ProductsLinux Server
Web server worker crash detection Finds repeated abnormal exits of nginx and Apache workers in a short time from the error log and alerts you. ActionDetect DefaultOn with Pro Notify only ProductsMac Linux Server

Persistence and tampering 7

Finds the ways attackers stay on after a reboot, and rewrites of critical files.

Feature What it does Action Default Products
Autostart registration monitoring T1543.001 T1543.002 T1053.003 T1546.004 Alerts you to new or modified autostart entries and to suspicious lines that appear in shell startup files and similar places. Finds reverse shells and download-and-run patterns. ActionDetect DefaultOn Notify only ProductsMac Linux
Critical system file tamper monitoring T1098.004 T1548.003 Records hashes of files only root can modify, such as sudoers, PAM, sshd settings and root's authorized_keys, and alerts you to changes, additions and deletions. On Server, it adds the process that made the change and its login information. ActionDetect Record DefaultOn with Pro Notify only ProductsMac Linux Server
Lock file tamper monitoring T1195.001 Records package-lock.json and similar files of registered projects and keeps alerting about changes until a person confirms them. ActionDetect DefaultOn with Pro Notify only ProductsMac
SUID/SGID change monitoring T1548.001 Alerts you to added and changed setuid and setgid files. ActionDetect DefaultOn Notify only ProductsLinux Server
Log wiping monitoring T1070.002 Alerts you when authentication logs and similar files are emptied or truncated. ActionDetect DefaultOn Notify only ProductsLinux Server
Kernel hardening T1055 Reduces footholds for privilege escalation and execution with ptrace restrictions, noexec on /tmp and /dev/shm, restrictions on unprivileged user namespaces and more. ActionBlock DefaultOn ProductsLinux Linux Server
Check of kernel modules that open privilege-escalation paths Checks whether modules that served as local privilege-escalation paths, such as Copy Fail and Dirty Frag, can be loaded. Modules you do not use can be blocked from loading. ActionAudit Control DefaultRun manually Manual response ProductsLinux Linux Server

Network defense 18

Adjusts protection to where you connect, and stops suspicious connections and exposure.

Feature What it does Action Default Products
Protection level switching by network Recognizes home, work and public Wi-Fi automatically and switches firewall and sharing-service settings. You can also override it manually. ActionControl Block DefaultOn Automatic response ProductsMac Linux
Automatic stop and restore of sharing services Stops SSH, screen sharing, file sharing and similar services on untrusted networks, and restores them when you return to a safe network. ActionControl Block DefaultOn Automatic response ProductsMac Linux
Audit of externally exposed ports Finds ports open to the outside and rates dangerous services and local AI inference servers. ActionAudit DefaultOn Notify only ProductsMac Linux Linux Server
Automatic blocking of unknown port exposure T1562.004 Blocks the moment a program never seen before opens a port to the outside. It works against new backdoors even without signatures. ActionDetect Block DefaultOn with Pro Automatic response ProductsMac Linux
Blocking external exposure of dev servers Shuts out the outer LAN from development servers and local AI servers that listen on all interfaces. They stay usable from localhost. ActionBlock DefaultOn with Pro Automatic response ProductsMac Linux
Detection and blocking of inbound port scans T1046 Finds sources that connect to many ports in a short time and blocks them for a set period. The gateway, DNS and your own addresses are never blocked. ActionDetect Block DefaultOn with Pro Automatic response ProductsMac Linux Linux Server
ARP spoofing detection and automatic blocking T1557.002 Finds suspicious changes to the gateway's MAC address and cuts communication in an emergency. On untrusted Wi-Fi, it pins the gateway's ARP entry. ActionDetect Isolate DefaultOn with Pro Automatic response ProductsMac Linux
Wi-Fi safety check Warns about connections to unencrypted Wi-Fi or weak encryption. A first-seen name that resembles a network name seen before is flagged as a fake access point. ActionDetect Audit DefaultOn Notify only ProductsMac Linux
Network setting change monitoring T1557.003 Compares the DNS servers, routers and proxy auto-configuration (PAC/WPAD) the network hands out with the previous state and alerts you when an unseen value appears. A lead for a rogue DHCP server. ActionDetect DefaultOn with Pro Notify only ProductsMac Linux
DNS threat protection Blocks name resolution for C2 servers and phishing sites at the DNS stage. It reverts when you return to a trusted network. ActionBlock DefaultOn Automatic response ProductsMac Linux
URL safety check Expands short URLs, follows redirects and judges look-alike characters, fake-brand domains and dangerous domains, all on the device. ActionAudit DefaultRun manually Manual response ProductsMac Linux
VPN and kill switch on untrusted networks Connects a VPN automatically on untrusted networks and blocks leaks outside the tunnel. You can choose WireGuard or Tailscale. ActionControl Block DefaultOpt-in Automatic response ProductsMac Linux
Air-Gap (emergency full cut-off) Cuts all external communication at once and brings the release steps to the front. It is also used for automatic cut-offs triggered by detections. ActionIsolate DefaultRun manually Manual response ProductsMac Linux
Wi-Fi shutdown during Air-Gap When Air-Gap cuts you off, it also turns the Wi-Fi radio off. ActionIsolate DefaultOn Automatic response ProductsMac
Default-deny inbound and SSH lockout prevention Denies inbound traffic by default and never drops the management SSH session you are connected with. ActionBlock DefaultOn Automatic response ProductsLinux Server
Blocking outbound traffic to malicious IPs Blocks outbound traffic to known malicious and C2 IPs. An option also points DNS to a filtering provider. ActionBlock DefaultOn Automatic response ProductsLinux Server
DNS tunneling detection T1071.004 Finds signs of data exfiltration and C2 over DNS and alerts you. ActionDetect DefaultOn Notify only ProductsLinux Server

Web and email 4

Finds malicious code placed on websites and attacks against web servers.

Feature What it does Action Default Products
Web shell and malicious code detection T1505.003 Finds web shells and obfuscated injected code in files written to public folders. Serious findings are quarantined by default. Public folders are found automatically from Apache, nginx and Caddy settings and Docker mounts. ActionDetect Block DefaultOn with Pro Automatic response ProductsMac Linux Server
Identifier enumeration detection (Web access guard) Finds, in access logs, requests that swap through receipt or order numbers one after another, including attacks spread across many IPs. When configured, it can block the sources it matches. ActionDetect Block DefaultOpt-in Notify only ProductsLinux Server
Web gate Works with nginx to protect only the places that accept identifiers, with a per-place request budget. It holds back attacks that keep changing IPs. ActionBlock DefaultOpt-in Automatic response ProductsLinux Server
File scan guard Scans files placed in mail relays, shared folders and similar locations with YARA and ClamAV, and quarantines them. ActionDetect Block DefaultOpt-in Automatic response ProductsLinux Server

SSH and remote access 2

Finds and stops login brute force, and checks for weak settings.

Feature What it does Action Default Products
SSH brute-force detection and blocking T1110.001 Finds and reports sources with repeated failed logins in a short time and blocks new connections to the SSH port. Established sessions are not cut, and the gateway and your own addresses are not blocked. ActionDetect Block DefaultOn with Pro Automatic response ProductsMac Linux Linux Server
SSH and sudo settings check T1548.003 Checks remote login settings for SSH and passwordless sudo, and shows how to fix them. ActionAudit DefaultOn Notify only ProductsMac Linux Linux Server

Containers and servers 6

Finds dangerous container launches and signs specific to servers.

Feature What it does Action Default Products
Dangerous container launch detection T1610 Alerts you when a privileged container or one that mounts docker.sock starts. Execution inside containers is monitored too. ActionDetect DefaultOpt-in Notify only ProductsMac Linux Server
Preventing Docker from bypassing the firewall Stops Docker from sidestepping default-deny rules and opening ports you did not mean to expose. ActionBlock DefaultOn Automatic response ProductsLinux Server
Resource exhaustion and crash detection Finds and alerts you to steadily growing memory use (leaks or DoS) in services exposed to the network, and to repeated crashes. ActionDetect DefaultOn Notify only ProductsLinux Server
Cloud metadata connection monitoring T1552.005 Alerts you when a non-root program or container connects to a metadata API such as 169.254.169.254. It watches the last step of an SSRF. ActionDetect DefaultOn Notify only ProductsLinux Server
Protection for dedicated AI agent accounts When agents run under their own account, it limits outbound traffic to an allowlist, places decoy credentials, and checks rewrites of instruction files against a root-owned baseline. ActionControl Detect DefaultOpt-in Notify only ProductsLinux Server
Processes that containment never stops You can add processes that automatic containment must not stop, on top of the built-in list. Only executables in system locations are valid. ActionControl Default— ProductsLinux Server

Supply chain 7

Finds intrusion through libraries and development environments, before and after they are pulled in.

Feature What it does Action Default Products
Matching packages against known vulnerabilities Matches installed packages and project lock files against vulnerability data held on the device. It makes no network connection. CVEs with an exploitation probability (EPSS) are sorted from the highest. ActionAudit DefaultRun manually Manual response ProductsMac Linux Linux Server
Vulnerability acceptance A CVE that does not affect you can be accepted with a reason and an expiry date. When it expires, it returns to normal detection. ActionControl Record DefaultRun manually Manual response ProductsMac Linux
Check of code that runs at install time T1195.001 Lists the scripts that run at install time. Alerts you to added or changed scripts and added compiled code compared with the confirmed state. ActionAudit DefaultRun manually Manual response ProductsMac Linux
Dependency source check Points out settings that open the door to dependency confusion, such as pip's extra-index-url or npm scopes without a pinned registry. ActionAudit DefaultRun manually Manual response ProductsMac
Look-alike package detection Judges by edit distance whether a dependency name is too close to a well-known package. ActionAudit DefaultRun manually Manual response ProductsMac Linux
npm package signature verification Verifies the signatures and provenance of installed packages against the npm registry. ActionAudit DefaultOpt-in Manual response ProductsMac Linux Server
Kernel vulnerability matching Matches the running kernel version against known vulnerabilities and shows the result in the diagnosis. ActionAudit DefaultOn Notify only ProductsLinux Linux Server

AI agents and MCP 6

Protects AI agent settings and the safety of the information handed to AI.

Feature What it does Action Default Products
AI agent setup audit Checks instruction files, skills and settings files. Points out invisible characters, instruction overrides, download-and-run lines, outbound sending of secret files and more. Alerts you when something changes from the approved state, and results can also be output as SARIF. ActionAudit Detect DefaultRun manually Notify only ProductsMac Linux Linux Server
MCP configuration review Points out risky entries in the MCP settings of Claude Desktop, Claude Code, Cursor and others: auto-approval, plain http, one-liner launches, privileged containers and more. ActionAudit DefaultRun manually Manual response ProductsMac Linux
Warning about instructions slipped in for the AI When strings from outside, such as package scripts, logs, Wi-Fi names and command lines, contain instructions aimed at the AI, a warning is added at the end of the result. It shows only the kinds found and their count. ActionDetect DefaultOn Notify only ProductsMac Linux Linux Server
MCP server for querying status from AI assistants Claude and others can read the status of diagnoses and detections. There are no tools that change settings, and no network communication. ActionReport DefaultOn ProductsMac Linux Linux Server
Self-check of detection coverage Lists, for each ATT&CK technique, whether it can be detected, what remains out of view, and whether the responsible feature is running now. It can also be output as an ATT&CK Navigator layer. ActionReport Audit DefaultOn ProductsMac Linux Linux Server
Local AI runtime identification Judges, with a confidence level, whether an exposed port belongs to a local AI runtime such as Ollama, vLLM or LiteLLM. ActionAudit DefaultOn Notify only ProductsMac Linux

Peripherals 3

Stops intrusion through USB and Bluetooth at the moment of connection.

Feature What it does Action Default Products
USB storage control T1091 USB storage you have not allowed is connected read-only or held back for your confirmation. Even allowed devices are read-only right after connection, and permissions return after the scan. ActionBlock Control DefaultOpt-in Manual response ProductsMac Linux
BadUSB prevention T1200 Blocks input from keyboards you have not approved and from modified USB cables until you approve them. Abnormal keystroke timing is used as a supporting clue. ActionBlock DefaultOpt-in Manual response ProductsMac Linux
Bluetooth control and check Makes the device undiscoverable over Bluetooth on untrusted networks. Also checks settings that let unpaired devices through. ActionControl Audit DefaultOpt-in Automatic response ProductsMac Linux

Diagnosis and vulnerabilities 5

Finds weak settings and vulnerabilities that can actually be reached.

Feature What it does Action Default Products
Overall security diagnosis Checks many items, including disk encryption, firewall, OS updates, SSH, open ports and browser protection, and shows a score and how to fix them. You can re-check whether a diagnosed item is still present. ActionAudit Report DefaultOn Notify only ProductsMac Linux Linux Server
Proof-based vulnerability scan Limited to 127.0.0.1 on this device, it confirms without causing damage exposure without authentication, CORS misconfiguration, path traversal and more. Each check shows what it leaves behind and how strong the evidence is. ActionAudit DefaultOpt-in Manual response ProductsMac Linux
LLMNR and NBNS response check T1557.001 Checks whether this device takes part in name resolution that anyone on the same network can answer. ActionAudit DefaultOn Notify only ProductsLinux Linux Server
Privilege escalation path analysis Shows, as a graph and a list, the paths that reach root or sensitive data through the docker group, SUID, writable service executables, passwordless sudo, cron, macOS privacy permissions and more. You can also run a what-if analysis of the paths after a fix. ActionAudit DefaultRun manually Manual response ProductsPathScope
Vulnerability audit from outside the LAN host A dedicated node on the LAN checks, without causing damage, the exposed ports and vulnerable services of paired devices. It shows how the device looks from another machine on the same LAN, which the host's own diagnosis cannot see. ActionAudit DefaultRun manually Manual response ProductsSensor

Log analysis and investigation 22

Finds attack attempts, with evidence, from logs and LAN information.

Feature What it does Action Default Products
Security log audit Tallies sudo failures, SSH, Gatekeeper blocks, authentication and more from logs. Log types seen for the first time and sudden increases in frequency are flagged as anomalies. Secrets are masked. ActionDetect Audit DefaultOn with Pro Notify only ProductsMac Linux Linux Server
Access log diagnosis (AccessScope) Finds attack attempts in web server and SSH logs, with the lines that prove them. It finds logs automatically and also shows chains across several logs and differences from the usual. What it could not read is shown in the report. ActionDetect Report DefaultRun manually ProductsAccessScope
One-button status check (PersonalSOC) Checks, read-only, SSH authentication, auditd, web, DNS and macOS unified logs, plus MCP settings and RoamSwitch's detection history. Compiles a dashboard and a report with IOCs. ActionReport Audit DefaultRun manually ProductsPersonalSOC
Autonomous investigation by an LLM (PersonalSOC, optional) When enabled, an LLM investigates using only the permitted read-only tools and writes a report. No shell or files are handed over. Values the LLM wrote that are not in the collected material are shown as possible fabrication. ActionReport DefaultOpt-in ProductsPersonalSOC
Scheduled runs (PersonalSOC, optional) Registers a scheduled run with user privileges and notifies you of the count only when there are detections that were not there last time. ActionReport DefaultOpt-in Notify only ProductsPersonalSOC
Where to fix and fix proposals (PathScope) Shows, with priorities, the places where fixing first has the biggest effect, with example fix commands and the matching ATT&CK techniques. Commands are never run automatically. ActionReport DefaultRun manually ProductsPathScope
Matching installed software against known vulnerabilities (PathScope) Matches the versions of installed software against the bundled data on known vulnerabilities (CISA KEV and others). Entries with a public exploit module are marked as such. ActionAudit DefaultRun manually ProductsPathScope
History comparison and continuous checks (PathScope) Keeps analysis results as a history on the device and compares them with the previous run. It reports new paths with exit code 1, so it also works in scheduled runs. ActionRecord Report DefaultRun manually ProductsPathScope
LLM explanations and reading of settings (PathScope, optional) You can hand the explanation of results and the reading of hard-to-read settings such as sudoers and cron to an LLM. Private keys and API key values are never sent. Values in an explanation that are not in the material are shown as possible fabrication. ActionReport DefaultOpt-in ProductsPathScope
Narrowing down what you review (AccessScope) Your own IPs and similar can be excluded with a reason, and it compares with the previous diagnosis to report only new detections. ActionControl DefaultRun manually ProductsAccessScope
Exporting results (AccessScope) Exports the report as Markdown, JSON, SARIF or CSV. It can also export a blocklist of the IPs it detected. It only exports; it does not block. ActionReport DefaultRun manually ProductsAccessScope
Analysis by an LLM (AccessScope, optional) When enabled, hands the summary and evidence lines to an LLM to write the report. Secrets are masked. Values the LLM wrote that are not in the material handed over are shown as possible fabrication. ActionReport DefaultOpt-in ProductsAccessScope
Detection of suspicious LAN traffic (Sensor, passive capture) With passive capture such as a mirror port, it shows as reference information connections to known malicious IPs and management ports, signs of botnet activity and DNS tunneling. It does not block traffic. ActionDetect DefaultOpt-in Notify only ProductsSensor
Scheduled audits and differences from the last run (Sensor) Audits paired devices at regular intervals and shows new findings, resolved ones and newly opened ports. ActionAudit Report DefaultOpt-in Notify only ProductsSensor
Audit reports and notifications (Sensor) Audit results, the device inventory and the operation log can be exported as CSV, JSON or HTML. New devices, ARP spoofing and more can be sent to a webhook and syslog. The operation log has tamper detection. ActionReport Record DefaultOpt-in Notify only ProductsSensor
LAN device inventory and ARP monitoring Discovers devices on the LAN, keeps an inventory, and alerts you to new devices and to changes of the MAC for a known IP (ARP spoofing). ActionDetect Record DefaultOn Notify only ProductsSensor
Rogue DHCP server and IPv6 router detection Sends a single discovery packet from a random MAC and counts the DHCP servers and IPv6 routers that answer. Alerts you to servers that appear later and to servers handing out a gateway different from the legitimate one. ActionDetect DefaultOn Notify only ProductsSensor
Learning each device's usual behavior Learns each device's communication habits and alerts you to behavior that differs from the usual. ActionDetect DefaultOn Notify only ProductsSensor
Light audit of unmanaged devices Checks devices that are not paired, such as printers and cameras, only within the range you allow, using connection checks and reading service banners. ActionAudit DefaultOpt-in Manual response ProductsSensor
Incident timeline Brings containment and detection records into one timeline, with the process lineage and ATT&CK tags. ActionReport Record DefaultOn ProductsMac Linux
List of connected USB devices Lists the external USB devices connected right now. ActionAudit DefaultOn ProductsMac
Protection right after boot (experimental) From an early stage of boot until the system is ready, blocks all traffic except ARP and DHCP clients. ActionBlock DefaultOpt-in Automatic response ProductsLinux Linux Server

Evidence, notification and operations 14

Keeps evidence of detections, tells the people who need to know, and fits into operations.

Feature What it does Action Default Products
Self-monitoring and automatic restart T1562.001 If RoamSwitch itself exits abnormally, it restarts and tells you. ActionControl Detect DefaultOn Automatic response ProductsMac Linux
Automatic updates of signed threat data Receives threat feeds, vulnerability data and rules after verifying their signatures. No information about the device is sent. ActionControl DefaultOn ProductsMac Linux Linux Server
Uninstall that restores everything Before removal, it restores network settings and removes decoy files and added settings. ActionControl DefaultRun manually Manual response ProductsMac Linux Linux Server
Central management by an organization (Fleet) Enrolls devices in an organization and receives and applies signed policies. On the device, you can check the enrollment and policy state. ActionControl Report DefaultOpt-in ProductsLinux Linux Server
Periodic autonomous patrol Runs the overall diagnosis periodically in the background. ActionAudit DefaultOn Notify only ProductsMac
Automatic evidence capture on containment When containment starts, it collects the evidence at that moment automatically. Integrity can be confirmed with the SHA-256 of each file. ActionRecord DefaultOn Automatic response ProductsMac Linux
Notification history Shows recent notifications with the responsible program, command and path. When the cause cannot be identified, it says so. ActionRecord Report DefaultOn ProductsMac Linux Linux Server
Emergency notifications (Telegram, LINE, Webhook) Sends serious detections to Telegram, LINE and webhooks. Slack, Discord and Teams work through an incoming webhook URL. ActionReport DefaultOpt-in Notify only ProductsLinux Server
Event forwarding (SIEM, syslog, Webhook) Forwards detections and notifications to the syslog, JSON Lines file or signed webhook you specify. What could not be sent is retried. ActionReport DefaultOpt-in ProductsMac Linux Server
Records with tamper detection Chains the execution record with hashes so it can be verified later. Checkpoints are also placed at regular intervals within the segment being written. ActionRecord DefaultOn ProductsMac Linux Linux Server
Operate every feature from the terminal All Server Edition features can be operated by keyboard alone on an 80x24 screen over SSH. Settings show a diff before saving, and a backup is taken. ActionControl DefaultOn ProductsLinux Server
Pairing and revocation With a one-time code, the device and the Sensor trust each other. If one is lost or stolen, revoke it from the collector and that Sensor stops by itself. ActionControl Default— Manual response ProductsSensor
Aggregating several sites (collector) Collects the summaries of several Sensors with signatures. See the status of each site on a dashboard and export it as CSV. ActionReport DefaultOpt-in ProductsSensor

What stops automatically and what only notifies

Which features act on their own after a detection, and which only notify you.

Block or isolate automatically 27

Feature Action Default Products
Mass-encryption detection ActionDetect Isolate DefaultOn with Pro ProductsMac Linux
Malware scan right after download ActionDetect Block DefaultOn ProductsMac Linux
Integration with Apple's malware detection ActionIsolate DefaultOn with Pro ProductsMac
ClickFix detection ActionDetect Block DefaultOpt-in ProductsMac Linux
Pre-execution blocking of dangerous programs ActionBlock DefaultOn ProductsLinux
Kernel-level intrusion detection and autonomous isolation ActionDetect Isolate DefaultOn ProductsLinux Server
Protection level switching by network ActionControl Block DefaultOn ProductsMac Linux
Automatic stop and restore of sharing services ActionControl Block DefaultOn ProductsMac Linux
Automatic blocking of unknown port exposure ActionDetect Block DefaultOn with Pro ProductsMac Linux
Blocking external exposure of dev servers ActionBlock DefaultOn with Pro ProductsMac Linux
Detection and blocking of inbound port scans ActionDetect Block DefaultOn with Pro ProductsMac Linux Linux Server
ARP spoofing detection and automatic blocking ActionDetect Isolate DefaultOn with Pro ProductsMac Linux
DNS threat protection ActionBlock DefaultOn ProductsMac Linux
Link protection ActionDetect Block DefaultOn ProductsMac Linux
VPN and kill switch on untrusted networks ActionControl Block DefaultOpt-in ProductsMac Linux
Wi-Fi shutdown during Air-Gap ActionIsolate DefaultOn ProductsMac
Default-deny inbound and SSH lockout prevention ActionBlock DefaultOn ProductsLinux Server
Blocking outbound traffic to malicious IPs ActionBlock DefaultOn ProductsLinux Server
Web shell and malicious code detection ActionDetect Block DefaultOn with Pro ProductsMac Linux Server
Web gate ActionBlock DefaultOpt-in ProductsLinux Server
File scan guard ActionDetect Block DefaultOpt-in ProductsLinux Server
SSH brute-force detection and blocking ActionDetect Block DefaultOn with Pro ProductsMac Linux Linux Server
Preventing Docker from bypassing the firewall ActionBlock DefaultOn ProductsLinux Server
Bluetooth control and check ActionControl Audit DefaultOpt-in ProductsMac Linux
Protection right after boot (experimental) ActionBlock DefaultOpt-in ProductsLinux Linux Server
Self-monitoring and automatic restart ActionControl Detect DefaultOn ProductsMac Linux
Automatic evidence capture on containment ActionRecord DefaultOn ProductsMac Linux

Notify only 42

Feature Action Default Products
Detection with decoy files ActionDetect Isolate DefaultOn with Pro ProductsMac Linux Linux Server
Backup freshness check ActionAudit DefaultOn ProductsMac Linux Linux Server
Credential decoys ActionDetect DefaultOn with Pro ProductsMac Linux Linux Server
Credential file read monitoring ActionDetect DefaultOn ProductsLinux
Browser saved-data monitoring ActionDetect DefaultOpt-in ProductsMac
AI agent sign-in data check ActionAudit DefaultOn ProductsMac
Process execution recording and attack-technique detection ActionDetect Record DefaultOpt-in ProductsMac Linux Linux Server
Sigma rule import ActionDetect DefaultOpt-in ProductsMac Linux Linux Server
Reverse shell detection ActionDetect DefaultOn with Pro ProductsMac Linux Linux Server
File content pattern matching ActionDetect DefaultOn ProductsMac Linux Linux Server
Web server worker crash detection ActionDetect DefaultOn with Pro ProductsMac Linux Server
Autostart registration monitoring ActionDetect DefaultOn ProductsMac Linux
Critical system file tamper monitoring ActionDetect Record DefaultOn with Pro ProductsMac Linux Server
Lock file tamper monitoring ActionDetect DefaultOn with Pro ProductsMac
SUID/SGID change monitoring ActionDetect DefaultOn ProductsLinux Server
Log wiping monitoring ActionDetect DefaultOn ProductsLinux Server
Audit of externally exposed ports ActionAudit DefaultOn ProductsMac Linux Linux Server
Wi-Fi safety check ActionDetect Audit DefaultOn ProductsMac Linux
Network setting change monitoring ActionDetect DefaultOn with Pro ProductsMac Linux
DNS tunneling detection ActionDetect DefaultOn ProductsLinux Server
Identifier enumeration detection (Web access guard) ActionDetect Block DefaultOpt-in ProductsLinux Server
SSH and sudo settings check ActionAudit DefaultOn ProductsMac Linux Linux Server
Dangerous container launch detection ActionDetect DefaultOpt-in ProductsMac Linux Server
Resource exhaustion and crash detection ActionDetect DefaultOn ProductsLinux Server
Cloud metadata connection monitoring ActionDetect DefaultOn ProductsLinux Server
Protection for dedicated AI agent accounts ActionControl Detect DefaultOpt-in ProductsLinux Server
Kernel vulnerability matching ActionAudit DefaultOn ProductsLinux Linux Server
AI agent setup audit ActionAudit Detect DefaultRun manually ProductsMac Linux Linux Server
Warning about instructions slipped in for the AI ActionDetect DefaultOn ProductsMac Linux Linux Server
Local AI runtime identification ActionAudit DefaultOn ProductsMac Linux
Overall security diagnosis ActionAudit Report DefaultOn ProductsMac Linux Linux Server
LLMNR and NBNS response check ActionAudit DefaultOn ProductsLinux Linux Server
Security log audit ActionDetect Audit DefaultOn with Pro ProductsMac Linux Linux Server
Scheduled runs (PersonalSOC, optional) ActionReport DefaultOpt-in ProductsPersonalSOC
Detection of suspicious LAN traffic (Sensor, passive capture) ActionDetect DefaultOpt-in ProductsSensor
Scheduled audits and differences from the last run (Sensor) ActionAudit Report DefaultOpt-in ProductsSensor
Audit reports and notifications (Sensor) ActionReport Record DefaultOpt-in ProductsSensor
LAN device inventory and ARP monitoring ActionDetect Record DefaultOn ProductsSensor
Rogue DHCP server and IPv6 router detection ActionDetect DefaultOn ProductsSensor
Learning each device's usual behavior ActionDetect DefaultOn ProductsSensor
Periodic autonomous patrol ActionAudit DefaultOn ProductsMac
Emergency notifications (Telegram, LINE, Webhook) ActionReport DefaultOpt-in ProductsLinux Server

Manual response 21

Feature Action Default Products
Restoring files from before the damage ActionControl Record DefaultOn ProductsMac Linux
API key and private key detection ActionAudit DefaultOn ProductsMac Linux Linux Server
Check of kernel modules that open privilege-escalation paths ActionAudit Control DefaultRun manually ProductsLinux Linux Server
URL safety check ActionAudit DefaultRun manually ProductsMac Linux
Air-Gap (emergency full cut-off) ActionIsolate DefaultRun manually ProductsMac Linux
Matching packages against known vulnerabilities ActionAudit DefaultRun manually ProductsMac Linux Linux Server
Vulnerability acceptance ActionControl Record DefaultRun manually ProductsMac Linux
Check of code that runs at install time ActionAudit DefaultRun manually ProductsMac Linux
Dependency source check ActionAudit DefaultRun manually ProductsMac
Look-alike package detection ActionAudit DefaultRun manually ProductsMac Linux
npm package signature verification ActionAudit DefaultOpt-in ProductsMac Linux Server
MCP configuration review ActionAudit DefaultRun manually ProductsMac Linux
USB storage control ActionBlock Control DefaultOpt-in ProductsMac Linux
BadUSB prevention ActionBlock DefaultOpt-in ProductsMac Linux
Proof-based vulnerability scan ActionAudit DefaultOpt-in ProductsMac Linux
Privilege escalation path analysis ActionAudit DefaultRun manually ProductsPathScope
Vulnerability audit from outside the LAN host ActionAudit DefaultRun manually ProductsSensor
Light audit of unmanaged devices ActionAudit DefaultOpt-in ProductsSensor
Uninstall that restores everything ActionControl DefaultRun manually ProductsMac Linux Linux Server
Receiving audits from Sensor ActionControl Audit DefaultOpt-in ProductsLinux Server
Pairing and revocation ActionControl Default— ProductsSensor

What is covered and what is not 52

For each attack technique (MITRE ATT&CK): detected, partly detected, or not covered.

Technique Mac Linux Linux Server
T1027 Obfuscated Files or Information Mac— LinuxPartial Linux ServerPartial
T1027.010 Obfuscated Files or Information: Command Obfuscation MacPartial Linux— Linux Server—
T1036 Masquerading MacNot covered LinuxNot covered Linux ServerNot covered
T1037.004 Boot or Logon Initialization Scripts: RC Scripts Mac— LinuxPartial Linux ServerNot covered
T1046 Network Service Discovery MacPartial Linux— Linux Server—
T1053.003 Scheduled Task/Job: Cron Mac— LinuxPartial Linux ServerPartial
T1055 Process Injection MacNot covered LinuxPartial Linux ServerPartial
T1055.008 Process Injection: Ptrace System Calls Mac— LinuxPartial Linux ServerPartial
T1059.002 Command and Scripting Interpreter: AppleScript MacPartial Linux— Linux Server—
T1059.004 Command and Scripting Interpreter: Unix Shell MacPartial LinuxPartial Linux ServerPartial
T1068 Exploitation for Privilege Escalation Mac— LinuxPartial Linux ServerPartial
T1070.002 Indicator Removal: Clear Linux or Mac System Logs MacNot covered LinuxNot covered Linux ServerPartial
T1070.003 Indicator Removal: Clear Command History MacNot covered LinuxNot covered Linux ServerNot covered
T1070.004 Indicator Removal: File Deletion Mac— LinuxPartial Linux ServerPartial
T1071.004 Application Layer Protocol: DNS Mac— LinuxPartial Linux ServerPartial
T1091 Replication Through Removable Media MacPartial Linux— Linux Server—
T1098.004 Account Manipulation: SSH Authorized Keys MacPartial LinuxPartial Linux ServerPartial
T1105 Ingress Tool Transfer Mac— LinuxPartial Linux ServerPartial
T1110.001 Brute Force: Password Guessing MacDetected LinuxPartial Linux ServerPartial
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools MacPartial Linux— Linux Server—
T1200 Hardware Additions MacPartial Linux— Linux Server—
T1204.002 User Execution: Malicious File MacPartial Linux— Linux Server—
T1204.004 User Execution: Malicious Copy and Paste MacPartial Linux— Linux Server—
T1486 Data Encrypted for Impact MacPartial LinuxPartial Linux ServerPartial
T1490 Inhibit System Recovery MacPartial LinuxPartial Linux ServerPartial
T1505.003 Server Software Component: Web Shell MacPartial LinuxPartial Linux ServerPartial
T1543.001 Create or Modify System Process: Launch Agent MacDetected Linux— Linux Server—
T1543.002 Create or Modify System Process: Systemd Service Mac— LinuxPartial Linux ServerPartial
T1543.004 Create or Modify System Process: Launch Daemon MacDetected Linux— Linux Server—
T1546.004 Event Triggered Execution: Unix Shell Configuration Modification MacPartial LinuxPartial Linux ServerPartial
T1546.016 Event Triggered Execution: Installer Packages Mac— LinuxPartial Linux ServerNot covered
T1546.017 Event Triggered Execution: Udev Rules Mac— LinuxPartial Linux ServerNot covered
T1547.015 Boot or Logon Autostart Execution: Login Items MacNot covered Linux— Linux Server—
T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid Mac— LinuxNot covered Linux ServerPartial
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching MacPartial Linux— Linux Server—
T1552.001 Unsecured Credentials: Credentials In Files MacPartial LinuxPartial Linux ServerPartial
T1552.005 Unsecured Credentials: Cloud Instance Metadata API Mac— LinuxNot covered Linux ServerPartial
T1553.001 Subvert Trust Controls: Gatekeeper Bypass MacPartial Linux— Linux Server—
T1555.001 Credentials from Password Stores: Keychain MacPartial Linux— Linux Server—
T1555.003 Credentials from Password Stores: Credentials from Web Browsers MacPartial Linux— Linux Server—
T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay MacNot covered LinuxPartial Linux ServerNot covered
T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning MacPartial LinuxPartial Linux ServerNot covered
T1557.003 Adversary-in-the-Middle: DHCP Spoofing MacPartial LinuxPartial Linux ServerNot covered
T1562.001 Impair Defenses: Disable or Modify Tools MacPartial LinuxPartial Linux ServerPartial
T1562.004 Impair Defenses: Disable or Modify System Firewall MacNot covered LinuxPartial Linux ServerNot covered
T1562.006 Impair Defenses: Indicator Blocking MacNot covered LinuxNot covered Linux ServerPartial
T1562.012 Impair Defenses: Disable or Modify Linux Audit System Mac— LinuxNot covered Linux ServerNot covered
T1566.002 Phishing: Spearphishing Link MacPartial Linux— Linux Server—
T1574.004 Hijack Execution Flow: Dylib Hijacking MacNot covered Linux— Linux Server—
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking MacPartial LinuxPartial Linux ServerPartial
T1610 Deploy Container MacPartial Linux— Linux Server—
T1620 Reflective Code Loading Mac— LinuxPartial Linux ServerPartial

"Not covered" means there is no mechanism that detects that technique.