Nightingale

numbat is an open-source endpoint security tool for monitoring AI-agent activity across supported desktop, CLI, IDE, and gateway agents. It combines local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts, normalizes live and stored activity into a common event model, and evaluates it locally with built-in, sequence-based, or custom YAML CEL rules. The tool can produce NDJSON events, findings, enforcement decisions, indicators, and scan summaries for alerting and forensic reconstruction, including read-only artifact scans, per-session timelines, and portable case bundles with SHA-256 manifests. Optional pre-action blocking is disabled by default and is limited to supported synchronous hooks and explicitly enforced rules. It is distributed as a single cgo-free binary for macOS, Linux, and Windows, with read-only inventory and scanning commands.

NetWatch is a real-time network diagnostics tool that runs in the terminal as a single, configuration-free binary. It captures network activity, attributes connections to processes where available, decodes application-layer protocols, fingerprints clients with JA4, tracks streams, and displays connections, interfaces, packets, protocol statistics, topology, timelines, per-process bandwidth, and egress destinations. Its diagnostic engine learns baselines, applies diagnostic rules, ranks possible causes, and records issues through verified closure. Egress linting observes destinations, promotes policies, and alerts when activity drifts from them; the tool also supports TLS 1.3 decryption for user traffic, PCAP export, display filters, beaconing and DNS-tunneling analysis, and Prometheus metrics. NetWatch provides full, lite, and dense terminal views and can run without elevated privileges for basic information, while capture features may require sudo or Linux capabilities. It is distributed for macOS, Linux, Windows, and other platforms through package managers, binaries, and a container. The repository is MIT-licensed; optional LLM commentary in the Diagnose view is disabled by default.

Grafana is an open-source observability and data visualization platform for querying, visualizing, alerting on, and understanding metrics, logs, and traces from multiple data sources. It provides client-side graphs and panel plugins, reusable dashboards with template variables, ad hoc metric queries and drilldowns, log search with preserved label filters, and alert rules that can send notifications to systems such as Slack, PagerDuty, VictorOps, and OpsGenie. Queries can combine different data sources in the same graph, including Prometheus, Loki, Elasticsearch, InfluxDB, PostgreSQL, and other custom data sources. The project is distributed under AGPL-3.0-only, with Apache-2.0 exceptions documented in its licensing files.

Prometheus is a Cloud Native Computing Foundation monitoring system and time-series database. It collects metrics from configured targets at intervals, evaluates rule expressions, displays results, and can trigger alerts when specified conditions occur. Its architecture uses a multi-dimensional time-series data model, the PromQL query language, an HTTP pull model, service discovery or static target configuration, and autonomous single-server nodes without a dependency on distributed storage. It is distributed as precompiled binaries, Docker images, and source code, with graphing, dashboarding, federation, and an intermediary gateway for batch-job metric pushes.

netmon is a self-hosted local-network monitor that periodically measures download and upload speed, ping latency, ISP, and test-server details, then scans the local subnet with nmap ARP scanning to count active devices. It stores the measurements and device counts in a local SQLite database and uses matplotlib to produce 24-hour trend graphs. The monitor sends status updates and periodic reports to Telegram or Discord. Reports can include sarcastic LLM-generated analysis through an OpenAI-compatible API, including a local LLM server. It runs on macOS or Linux, uses Python and uv, and requires system installations of nmap and speedtest-cli; device counting requires passwordless sudo access for nmap.