#What RoamSwitch protects
RoamSwitch is a family of products that protect Mac and Linux machines from attacks. What it protects is organized into chapters: ransomware, credential theft, suspicious execution, network attacks, supply chain, AI agents, and more. The full list is on the feature list.
These lessons use those features as the subject, and follow this order:
- Learn how the attack works
- Build the same situation with harmless data
- Check from real output what RoamSwitch finds
- Learn what it cannot see
In every module, read through to step 4, "what it cannot see." You can only build a defense when you know what you are not watching.
#Seven actions, and the role of each edition
By action, features fall into seven kinds. A single feature can have more than one.
| Action | Meaning |
|---|---|
| Detect | Find something abnormal and tell you |
| Block | Stop a connection or an execution |
| Isolate | Cut off a suspicious file or machine |
| Audit | Inspect settings and state, and point out weak spots |
| Record | Keep the facts so you can investigate later |
| Report | Summarize the result and tell you |
| Control | Keep a setting or a service the way you decided |
The editions differ by what they protect.
| Edition | What it protects |
|---|---|
| Mac | A Mac desktop or laptop |
| Linux Client | A Linux desktop |
| Linux Server | A server that runs all the time (runtime monitoring, file tamper detection, SSH protection, and more) |
| Sensor | The state of your LAN, seen from the outside of the network |
There are also bundled apps. AccessScope diagnoses access logs, and PathScope analyzes privilege-escalation paths.
Even among "detect" features, some only notify and some respond automatically. The feature list shows which, under "what happens when it detects." A feature that stops things automatically costs more when it is wrong, so some are on by default and some you turn on yourself.
#A design that does not phone home
RoamSwitch does not send your data out. It does have communication to receive threat data, though.
- It only receives signed update data (vulnerability maps, threat lists, detection rules) on a schedule, mostly once a day. The only thing it sends is the request to receive, and that carries no identifier
- It uses received data only after the signature and the contents pass checks
- Apart from the part that receives updates, the code has no networking components at all, by design, and the development checks (CI) verify it
Most read-only inspection commands do not communicate when you run them. The command descriptions (roamswitch help) say "no communication."
#Lab: check that your machine is ready
RoamSwitch has an inspection command called RoamSwitch self-check (doctor). It changes nothing, and checks whether this machine meets the conditions for RoamSwitch to run. Run it with administrator rights to check everything.
sudo roamswitch doctorThis is an excerpt of a run without administrator rights (Server Edition, Ubuntu 26.04).
[注意] root ではないため、root だけが読める状態は確認できません。sudo roamswitch doctor で実行すると、すべて確認できます
[正常] nft: /usr/sbin/nft
[正常] systemctl: /usr/bin/systemctl
[注意] clamscan が見つかりません。一部の機能が使えません
[正常] RoamSwitch のデーモンが動いています
[注意] ufw も動いていて、ファイアウォールの規則を書き換えます。RoamSwitch の規則と重なることがあります
[正常] 署名つきデータの更新は動いています。最後の成功: 2026-11-02 11:35 UTC
失敗はありません(注意 5 件)The output follows the language of your RoamSwitch settings (this example is in Japanese). How to read it:
- 正常 (OK): the condition is met
- 注意 (Notice): it works, but there is something to know. Here, another firewall (ufw) is running, and its rules may overlap
- 失敗 (Failure): there is a reason it cannot run. The exit code becomes 1, so a script can detect it
#Lab: read "what it cannot see"
For each attack technique (MITRE ATT&CK), RoamSwitch can write out what it watches and what it does not.
roamswitch detection-coverage --server | head -12🧭 検知の範囲の自己点検 (MITRE ATT&CK) (Server Edition)
38件中: 検知 0 / 一部 25 / 見ていない 13。対応するガードが止まっている項目: 0
🟡 T1685 Disable or Modify Tools [一部] 稼働中
担当: ebpfHeartbeat, criticalPathFim
見えない部分: 確認するのは Falco の警報の経路だけで、Falco のユニットが動いているときに限ります。(以下略)
⬜ T1686 Disable or Modify System Firewall [見ていない] -
見えない部分: フラッシュされても、デーモンは自分のテーブルを30秒ほどで作り直しますが、それは自分のルールの自己修復です。ホストのファイアウォールの変更は見ておらず、知らせもしません。The numbers change with the version. Look at the line that says "検知 0" (0 detected). In this output, no technique is claimed to be "fully detected." The product itself puts its blind spots into words.
In short: "38 techniques: 0 detected / 25 partial / 13 not watched, and 0 items whose guard has stopped." The first entry says the check covers only the path of Falco alerts, and only while Falco's unit runs. The second says the daemon repairs its own firewall table, but does not watch changes to the host's firewall.
In the range covered by this module, the following were not verified.
- Whether everything is found when an attacker with administrator rights stops RoamSwitch itself or rewrites its settings. As the output above says, there are parts where, if the daemon is stopped, it cannot tell you by itself
- Even when the inspection command says "no failures," that does not prove you are not under attack. It means the conditions for running are met
What does it mean when detection-coverage shows a technique as "not watched"?
Show the explanation
"Not watched" means the technique is outside the product's detection range. It has nothing to do with whether an attack is happening. A stopped guard is counted in a separate field (items whose guard has stopped).
#What to learn next
- To learn by what you protect, start with Credential theft and leaked secrets or Supply-chain attacks
- If you run servers, An actively exploited vulnerability has no fix yet is the first crisis playbook
Verified on 2026-11-03. Target: Linux 1.17.30. Ran every listed command on Ubuntu 26.04, Server Edition
Command output varies with the product version and the environment. If yours differs, check the version first.