Skip to content

Nick v1.2 — AI & Reporting

Choose a tag to compare

View all tags
@EhsanAzish80 EhsanAzish80 released this 25 May 18:24
v1.2
81ac295

Nick v1.2 — AI & Reporting

One app. Six detection layers. On-device AI threat scoring. Zero cloud dependency.

New: Logging & SIEM Integration

Nick now ships a functional logging pipeline. Pick your format, pick your output, done.

  • Formats: Key=Value · JSON · CEF
  • Outputs: Local log file (~/Library/Logs/Nick/nick-YYYY-MM-DD.log, daily rotation, 30-day retention) · HTTP POST webhook (Splunk HEC, AWS, PagerDuty, any HTTPS endpoint) · stdout
  • MDM-configurable — all logging settings readable from the managed defaults domain com.ehsanazish.nick
  • No syslog. No OpenTelemetry. No dedicated developer required.

New: Detection Additions

  • Finder Sync Extension — "Scan with Nick" appears automatically in Finder right-click menu, no user configuration needed
  • Scheduled Deep Scan — daily, weekly, or monthly full-system YARA scan (configurable in Settings)
  • getListeningPorts implemented via sysctl — closes #43
  • proc_pidfdinfo replaces lsof for network scanning — closes #1
  • Network baseline anomaly detection — flags processes whose connection patterns change unexpectedly

New: Enterprise Foundation

  • MDM configuration profile support — all settings configurable via managed com.ehsanazish.nick defaults domain. See docs/MDM_CONFIGURATION.md
  • Configurable alert suppression rules — suppress by process name, file path, or correlation rule name

AI Improvements

  • Foundation Models explanations now on all alert paths (full scan + quickTick)
  • Opt-in local signal telemetry for future CoreML model training

UI Improvements

  • Follows system dark/light mode — user can override in Settings → Appearance
  • Hero card with green tint background
  • Score merged into hero card
  • Status rows are interactive buttons with hover state
  • HTTP endpoint field fixed (full width, LTR, URL validation, test alert button)
  • Suppression Rules form redesigned
  • monitoringSince persists correctly across restarts

Bug Fixes

  • Fixed launchd (PID 1) failing signature validation
  • Fixed ULA IPv6 (fd::/fc::) addresses triggering raw IP alerts
  • Fixed Deep Scan YARA matches in signed app data generating alerts
  • Fixed webhook URL field rendering as tappable link
  • Fixed empty divider in Suppression Rules when list is empty

Requirements

  • macOS 26 or later
  • Apple Silicon or Intel Mac

Installation

  1. Download Nick-v1.2.dmg
  2. Open the DMG and drag Nick to Applications
  3. Launch Nick from Applications

Verification

codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v1.2.dmg
# Expected: fee2f06dcafc4ce571d064584e3b149b791a988663bb65d204226c20d8616b08

Security

Report vulnerabilities via GitHub Security Advisories or security@3nsofts.com.
See SECURITY.md for our disclosure policy.

License

AGPL-3.0

Assets 3
Loading
0 Join discussion