Nick v1.2 — AI & Reporting

[EhsanAzish80]

Nick v1.2 — AI & Reporting

One app. Six detection layers. On-device AI threat scoring. Zero cloud dependency.

New: Logging & SIEM Integration

Nick now ships a functional logging pipeline. Pick your format, pick your output, done.

• Formats: Key=Value · JSON · CEF
• Outputs: Local log file (~/Library/Logs/Nick/nick-YYYY-MM-DD.log, daily rotation, 30-day retention) · HTTP POST webhook (Splunk HEC, AWS, PagerDuty, any HTTPS endpoint) · stdout
• MDM-configurable — all logging settings readable from the managed defaults domain com.ehsanazish.nick
• No syslog. No OpenTelemetry. No dedicated developer required.

New: Detection Additions

• Finder Sync Extension — "Scan with Nick" appears automatically in Finder right-click menu, no user configuration needed
• Scheduled Deep Scan — daily, weekly, or monthly full-system YARA scan (configurable in Settings)
• getListeningPorts implemented via sysctl — closes #43
• proc_pidfdinfo replaces lsof for network scanning — closes Welcome to Nick Discussions! #1
• Network baseline anomaly detection — flags processes whose connection patterns change unexpectedly

New: Enterprise Foundation

• MDM configuration profile support — all settings configurable via managed com.ehsanazish.nick defaults domain. See docs/MDM_CONFIGURATION.md
• Configurable alert suppression rules — suppress by process name, file path, or correlation rule name

AI Improvements

• Foundation Models explanations now on all alert paths (full scan + quickTick)
• Opt-in local signal telemetry for future CoreML model training

UI Improvements

• Follows system dark/light mode — user can override in Settings → Appearance
• Hero card with green tint background
• Score merged into hero card
• Status rows are interactive buttons with hover state
• HTTP endpoint field fixed (full width, LTR, URL validation, test alert button)
• Suppression Rules form redesigned
• monitoringSince persists correctly across restarts

Bug Fixes

• Fixed launchd (PID 1) failing signature validation
• Fixed ULA IPv6 (fd::/fc::) addresses triggering raw IP alerts
• Fixed Deep Scan YARA matches in signed app data generating alerts
• Fixed webhook URL field rendering as tappable link
• Fixed empty divider in Suppression Rules when list is empty

Requirements

• macOS 26 or later
• Apple Silicon or Intel Mac

Installation

1. Download Nick-v1.2.dmg
2. Open the DMG and drag Nick to Applications
3. Launch Nick from Applications

Verification

codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v1.2.dmg
# Expected: fee2f06dcafc4ce571d064584e3b149b791a988663bb65d204226c20d8616b08

Security

Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.

License

AGPL-3.0

---

This discussion was created from the release Nick v1.2 — AI & Reporting.