🚀 Initial Release of pinspect
Fast Linux process-intelligence CLI and forensics tool that goes far beyond ps aux.
✨ Key Features
- Core Intelligence: PID/PPID, start time, CPU/Memory stats, ancestry tree, UID/GID credentials, groups, nice/scheduling policy, CPU affinity, and TTY.
- Launch / Origin Detection: Detects systemd services, cron jobs, SSH sessions, shells, Docker, Podman, and Kubernetes containers.
- Security & Capabilities Forensics: Decodes Linux capabilities (
CapEff,CapPrm,CapBnd), Seccomp modes, NoNewPrivs, AppArmor/SELinux profiles, SUID/SGID flags, unlinked binary execution, and SHA-256 hashes. - Files & Sockets: Inspects open file descriptors, deleted files in memory, listening ports, and established network/unix sockets.
- Secret Redaction: Redacts passwords, API tokens, AWS keys, and database credentials by default.
- Interactive TUI: Real-time curses dashboard with filtering, sorting, and tabbed inspection.
- SIEM / EDR Formats: Structured JSON (
--json) and CSV (--csv) output.
📦 Installation
pip install pinspect-cli