Project dossier
NETRUNNER
A macOS-focused local security observation tool with historical comparison, evidence storage, and explainable risk prioritization.
Project overview
NETRUNNER is a macOS local security observation tool for networks and devices the user owns or is authorized to assess. It collects ARP / socket, LAN, Wi-Fi, Bluetooth, Nmap, Masscan, Nikto, and OSINT evidence, stores raw files plus normalized SQLite history, and compares runs for new assets, changed ports, and persistent exposure. It outputs explainable 0–10 risk-priority reports with data-quality warnings; it is not real-time intrusion detection or proof that a device is dangerous or safe.
Skills developed
Data modeling, security reasoning, explainable risk prioritization, and failure semantics / evidence integrity.
Current progress
The core pipeline for local collection, normalized SQLite storage, historical baselines, and explainable threat prioritization is implemented with offline protocol and data-layer tests; the project is now moving into live macOS and dual-architecture packaging validation.
Next step
Next, I will run at least two consecutive `home` collections on real macOS hardware to validate historical baselines and data coverage, then build and verify the `arm64` and `x86_64` collector artifacts.
One-command setup and local report
git clone https://github.com/Keng0nion/netrunner-security-monitor.git NETRUNNER && cd NETRUNNER && python3 source/netrunner.py collect --profile home && python3 source/netrunner.py reportRun only on your own or explicitly authorized network. Requires Python 3 and Node.js 18+; Nmap, Masscan, Nikto, and TheHarvester remain optional extended collectors.