Advanced Modes

Advanced Modes

Continuous monitoring — --watch

python3 process_analyzer_allinone.py --watch --interval 30 --config config.yaml

Re-collects periodically (default 60 s, minimum 5 s), runs collection + rules only — Ollama is never called in a loop; AI enrichment stays a deliberate one-shot action. Each cycle prints the top consumers and the differences vs the previous cycle (new processes, gone processes, risk changes) and regenerates the HTML. Stop with Ctrl+C.

Single-process forensics — --pid

python3 process_analyzer_allinone.py --pid 1234 --no-enrich

Restricts the analysis to the target process plus its ancestors and all descendants, prints a detailed text report (identity, risk level and named signals, network connections, open files, SHA256 if --check-integrity, and the process tree), and generates the HTML for that subtree only.

History and comparison — --compare

Every run automatically appends a light snapshot to outputs/history.json (50 kept; --no-history to disable; sandbox runs are never recorded).

# Compare to the previous run
python3 process_analyzer_allinone.py --compare

# Compare to a specific JSON export
python3 process_analyzer_allinone.py --compare old_export.json

The report lists new processes, disappeared processes, risk level changes, and the largest CPU/RAM swings — useful for spotting slow-burning issues (memory leaks, creeping usage).

Performance baseline — --baseline

python3 process_analyzer_allinone.py --baseline

Each run with --baseline adds a CPU/RAM sample per process name (Welford running statistics). From 3 samples on, a value more than 2 standard deviations above the mean becomes a named anomaly signal ("medium" level). Deliberately conservative: near-zero variance and sub-5% values never trigger.

Executable integrity — --check-integrity

python3 process_analyzer_allinone.py --check-integrity

Computes the SHA256 of every executable (files > 200 MB skipped) and compares against outputs/integrity.json. Statuses: new, unchanged, modified, unreadable. A modified fingerprint is a "high" risk signal and never silently overwrites the reference — delete the database to re-baseline after a legitimate update.

Enrichment cache — --cache

python3 process_analyzer_allinone.py --cache --retry-failed 3

SQLite cache keyed on SHA256(name + exe + cmdline), default TTL 7 days (--cache-ttl-days). Identical processes are served without an LLM call; cached results are flagged from_cache; failed enrichments are never cached. --retry-failed N retries transient failures (timeout, saturated Ollama) sequentially with exponential backoff.

Sandbox — --sandbox

python3 process_analyzer_allinone.py --sandbox capture.json --config config.yaml --no-enrich

Replays a --json-export file instead of collecting the real system — test rule changes, whitelist/blacklist configs or rendering with zero risk, or analyze a capture taken on another machine.

Plugins — --plugin

# my_plugin.py
def enrich(process_info):
    # process_info: dict (pid, name, exe, cmdline, cpu_percent, connections, container...)
    if process_info.get("cpu_percent", 0) > 80:
        return {"alert": "critical CPU usage"}
    return {}

python3 process_analyzer_allinone.py --plugin my_plugin.py

The returned dict is merged into the process's enrichment (under plugin) and appears in JSON exports. Plugin errors are logged, never fatal.

Graph relationships export — --csv-edges

python3 process_analyzer_allinone.py --csv-edges edges.csv

One line per edge (parent/child, shared file, network connection) with the labels and risk levels of both endpoints — importable into Gephi, Neo4j or a spreadsheet.

Container awareness

On Linux, processes running in containers (Docker, Podman, containerd, Kubernetes) are detected via /proc/<pid>/cgroup; the short container id appears in the panel and the exports.