What did this process actually do?
SysSight reconstructs Linux process behavior from kernel/system-level events, turning raw activity into a navigable timeline of processes, files, and network connections - instead of a scrolling wall of individual syscalls.
python3
├── opened /tmp/config
├── created network socket
├── connected to 185.x.x.x:443
└── spawned /bin/sh
SysSight doesn't try to tell you "this is malware." It shows you what happened, with evidence, and lets you decide.
The block below isn't a mockup - it's the actual ratatui dashboard
code, rendered through syssight_tui::render_to_text() into an
in-memory buffer (no real terminal needed) against a genuine capture
recorded from examples/mixed_behavior/run.sh (see
crates/syssight-tui/examples/ascii_screenshot.rs; the file behind it
ships at docs/sample-capture.ssr). There's no bitmap screenshot or GIF
in this repository - generating one needs a graphical/pty recording tool
this project's sandboxed development environment didn't have access to
- so
scripts/demo.tape(for VHS) is included for anyone who wants to produce one; runvhs scripts/demo.tapeto getdocs/demo.gif.
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│SysSight — replay — root pid 917 — 24 events │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘
┌Process Tree─────────────────────┐┌Timeline───────────────────────────────────────────────────────┐
│/usr/bin/dash (pid 917) ││ 3058732ns EXEC pid=917 sh /usr/bin/dash sh exampl│
│ └─ /usr/bin/python3.12 (pid 920││ 3058732ns FORK pid=917 sh child=920 │
│ └─ /usr/bin/sleep (pid 921) ││ 3058732ns EXEC pid=920 python3 /usr/bin/python3.1│
│ └─ /usr/bin/python3.12 (pid 923││ 3058732ns FORK pid=917 sh child=921 │
│ └─ /usr/bin/dash (pid 924) ││ 3058732ns EXEC pid=921 sleep /usr/bin/sleep sleep│
│ └─ /usr/bin/sleep (pid 925) ││ 3058732ns OPEN pid=921 sleep /dev/null │
│ ││ 3058732ns OPEN pid=917 sh /dev/null │
│ ││ 3058732ns OPEN pid=917 sh /home/gab/syssight/e│
│ ││ 24701086ns BIND pid=920 python3 TCP 127.0.0.1:8972│
│ ││ 317640250ns FORK pid=917 sh child=923 │
│ ││ 317640250ns EXEC pid=923 python3 /usr/bin/python3.1│
│ ││ 317640250ns OPEN pid=923 python3 /dev/null │
│ ││ 317640250ns EXIT pid=921 sleep │
│ ││ 342704086ns FORK pid=917 sh child=924 │
│ ││ 342704086ns EXEC pid=924 sh /usr/bin/dash sh -c ech│
│ ││ 342704086ns FORK pid=924 sh child=925 │
│ ││ 342704086ns EXEC pid=925 sleep /usr/bin/sleep sleep│
└─────────────────────────────────┘└───────────────────────────────────────────────────────────────┘
┌Network────────────────┐┌Filesystem─────────────┐┌Events─────────────────┐┌Indicators─────────────┐
│1 connections ││6 files ││24 events ││0 indicators │
└───────────────────────┘└───────────────────────┘└───────────────────────┘└───────────────────────┘
q: quit p: pause/resume tab: switch pane j/k or ↑/↓: navigate /: search
```ocess behavior from kernel/system-level
events, turning raw activity into a navigable timeline of processes,
files, and network connections - instead of a scrolling wall of
individual syscalls.
```text
python3
├── opened /tmp/config
├── created network socket
├── connected to 185.x.x.x:443
└── spawned /bin/sh
SysSight doesn't try to tell you "this is malware." It shows you what happened, with evidence, and lets you decide.
The block below isn't a mockup - it's the actual ratatui dashboard
code, rendered through syssight_tui::render_to_text() into an
in-memory buffer (no real terminal needed) against a genuine capture
recorded from examples/mixed_behavior/run.sh (see
crates/syssight-tui/examples/ascii_screenshot.rs; the file behind it
ships at docs/sample-capture.ssr). There's no bitmap screenshot or GIF
in this repository - generating one needs a graphical/pty recording tool
this project's sandboxed development environment didn't have access to
- so
scripts/demo.tape(for VHS) is included for anyone who wants to produce one; runvhs scripts/demo.tapeto getdocs/demo.gif.
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│SysSight — replay — root pid 1057 — 23 events │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘
┌Process Tree─────────────────────┐┌Timeline───────────────────────────────────────────────────────┐
│/usr/bin/sleep (pid 1061) ││ 112830ns EXEC pid=1061 sleep /usr/bin/sleep sleep│
│/usr/bin/dash (pid 1057) ││ 112830ns EXEC pid=1057 sh /usr/bin/dash sh exampl│
│ └─ /usr/bin/python3.12 (pid 106││ 112830ns FORK pid=1057 sh child=1060 │
│ └─ /usr/bin/python3.12 (pid 106││ 112830ns EXEC pid=1060 python3 /usr/bin/python3.1│
│ └─ /usr/bin/dash (pid 1065) ││ 112830ns BIND pid=1060 python3 TCP 127.0.0.1:8972│
│ └─ /usr/bin/sleep (pid 1066) ││ 112830ns OPEN pid=1057 sh /dev/null │
│ ││ 112830ns OPEN pid=1057 sh /home/gab/syssight/e│
│ ││ 112830ns OPEN pid=1061 sleep /dev/null │
│ ││ 213639852ns FORK pid=1057 sh child=1064 │
│ ││ 213639852ns EXEC pid=1064 python3 /usr/bin/python3.1│
│ ││ 213639852ns OPEN pid=1064 python3 /dev/null │
│ ││ 213639852ns EXIT pid=1061 sleep │
│ ││ 257248744ns FORK pid=1057 sh child=1065 │
│ ││ 257248744ns EXEC pid=1065 sh /usr/bin/dash sh -c ech│
│ ││ 257248744ns FORK pid=1065 sh child=1066 │
│ ││ 257248744ns EXEC pid=1066 sleep /usr/bin/sleep sleep│
│ ││ 257248744ns OPEN pid=1066 sleep /dev/null │
└─────────────────────────────────┘└───────────────────────────────────────────────────────────────┘
┌Network────────────────┐┌Filesystem─────────────┐┌Events─────────────────┐┌Indicators─────────────┐
│1 connections ││6 files ││23 events ││0 indicators │
└───────────────────────┘└───────────────────────┘└───────────────────────┘└───────────────────────┘
q: quit p: pause/resume tab: switch pane j/k or ↑/↓: navigate /: search
```ocess behavior from kernel/system-level
events, turning raw activity into a navigable timeline of processes,
files, and network connections - instead of a scrolling wall of
individual syscalls.
```text
python3
├── opened /tmp/config
├── created network socket
├── connected to 185.x.x.x:443
└── spawned /bin/sh
SysSight doesn't try to tell you "this is malware." It shows you what happened, with evidence, and lets you decide.
The block below isn't a mockup - it's the actual ratatui dashboard
code, rendered through syssight_tui::render_to_text() into an
in-memory buffer (no real terminal needed) against a genuine capture
recorded from examples/mixed_behavior/run.sh (see
crates/syssight-tui/examples/ascii_screenshot.rs; the file behind it
ships at docs/sample-capture.ssr). There's no bitmap screenshot or GIF
in this repository - generating one needs a graphical/pty recording tool
this project's sandboxed development environment didn't have access to
- so
scripts/demo.tape(for VHS) is included for anyone who wants to produce one; runvhs scripts/demo.tapeto getdocs/demo.gif.
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│SysSight — replay — root pid 482 — 22 events │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘
┌Process Tree─────────────────────┐┌Timeline───────────────────────────────────────────────────────┐
│/usr/bin/python3.12 (pid 485) ││ 106362ns EXEC pid=485 python3 /usr/bin/python3.1│
│/usr/bin/sleep (pid 486) ││ 106362ns EXEC pid=486 sleep /usr/bin/sleep sleep│
│/usr/bin/dash (pid 482) ││ 106362ns EXEC pid=482 run.sh /usr/bin/dash /bin/│
│ └─ /usr/bin/python3.12 (pid 489││ 106362ns BIND pid=485 python3 TCP 127.0.0.1:8972│
│ └─ /usr/bin/dash (pid 490) ││ 106362ns OPEN pid=486 sleep /dev/null │
│ └─ /usr/bin/sleep (pid 491) ││ 106362ns OPEN pid=482 run.sh /dev/null │
│ ││ 106362ns OPEN pid=482 run.sh /home/gab/syssig│
│ ││ 207591112ns FORK pid=482 run.sh child=489 │
│ ││ 207591112ns EXEC pid=489 python3 /usr/bin/python3.1│
│ ││ 207591112ns OPEN pid=489 python3 /dev/null │
│ ││ 207591112ns EXIT pid=486 sleep │
│ ││ 253478733ns FORK pid=482 run.sh child=490 │
│ ││ 253478733ns EXEC pid=490 sh /usr/bin/dash sh -c ech│
│ ││ 253478733ns FORK pid=490 sh child=491 │
│ ││ 253478733ns EXEC pid=491 sleep /usr/bin/sleep sleep│
│ ││ 253478733ns OPEN pid=491 sleep /dev/null │
│ ││ 253478733ns OPEN pid=490 sh /dev/null │
└─────────────────────────────────┘└───────────────────────────────────────────────────────────────┘
┌Network────────────────┐┌Filesystem─────────────┐┌Events─────────────────┐┌Indicators─────────────┐
│1 connections ││6 files ││22 events ││0 indicators │
└───────────────────────┘└───────────────────────┘└───────────────────────┘└───────────────────────┘
q: quit p: pause/resume tab: switch pane j/k or ↑/↓: navigate /: search
Tools like strace show you every syscall with none of the narrative.
Tools like Falco/Tracee/Tetragon are built for fleet-wide policy
enforcement, not for answering "what did this one process do" in a
way you can navigate and replay later. SysSight is scoped narrowly: one
process tree, correlated into a tree/timeline, saved to a compact
capture format you can hand to someone else or look at tomorrow. See
docs/architecture/ebpf.md for the actual prior-art research this claim
is based on, not just an assertion.
1.0.2. See docs/development/stability-policy.md
for exactly what this version commits to - short version: the
procfs-based tool (CLI, .ssr format, correlation engine, TUI) is
stable and has 50 passing tests, including a new adversarial-input
suite that found and fixed two real, security-relevant bugs before
release (see CHANGELOG.md). The experimental CO-RE
eBPF backend is still designed but explicitly not built or
verified - that hasn't changed with this release; see
Limitations and LIMITATIONS.md.
git clone https://github.com/gabryxdev/SysSight.git
cd syssight
cargo build --release
sh examples/mixed_behavior/run.sh &
sudo ./target/release/syssight monitor --pid $!Full walkthrough with real, captured output: docs/guides/quickstart.md
(including a note on "Permission denied" running the example scripts -
a real distribution-channel gotcha, not hypothetical).
Platform-specific install steps: docs/guides/installation.md.
Or just run sh scripts/install.sh (builds, then asks before copying
anywhere - never uses sudo itself).
flowchart TD
K[Linux kernel] -->|"/proc reads (default)"| CAP[syssight-capture]
K -.->|"CO-RE eBPF (experimental, unverified)"| CAP
CAP --> CORE[syssight-core: sessions]
CORE --> CORR[syssight-correlation: process tree + indicators]
CORE --> FMT[syssight-format: .ssr read/write]
CORR --> TUI[syssight-tui]
CORR --> CLI[syssight-cli: inspect / --no-tui]
FMT -->|record| DISK[(capture.ssr)]
DISK -->|replay| FMT
Full breakdown of each crate and why the boundaries are drawn where they
are: docs/architecture/overview.md.
- Process monitoring: pid/ppid/tid/uid/gid, executable, command line, exec transitions, fork/exit, full process tree.
- Filesystem activity: open, create, write, delete*, rename*, permission changes* (*modeled in the data format and correlation engine; not yet observable by the default polling backend - see Limitations).
- Network activity: socket creation, TCP connect/bind, IPv4 and
IPv6, correlated to the owning process via
/proc/net+ fd inode matching. - Behavior correlation engine: process tree / event graph linking
processes to the files and sockets they touched - see
docs/architecture/correlation.md. - Rule-based indicators, not AI: three explicit, evidence-producing
rules (
shell_spawned_by_interpreter,write_then_execute,connect_then_spawn). No LLMs, no ML, no "93% malicious" scores - every indicator ships with the exact pids/paths/timestamps that triggered it. .ssrcapture format: a real, versioned, checksummed binary format - not JSON with a different extension. Record now, analyze later, on a different machine, without the process still running. Seedocs/format/ssr-format.md.- Terminal UI:
ratatui-based, process tree + timeline + network/filesystem/indicator summary, keyboard navigation, search, pause/resume - shared between live monitoring and replay via a singleDataSourcetrait. --no-tui/--format jsonon every relevant command, for scripting.
# Watch a process live
syssight monitor --pid 4312
# Record for later analysis
syssight record --pid 4312 --output capture.ssr --duration-secs 30
# Look at it later, no process required
syssight replay capture.ssr
syssight inspect capture.ssr --format json
# Check what SysSight needs on this host
syssight doctorexamples/ has four self-contained demo scripts
(process_tree, filesystem_activity, network_activity,
mixed_behavior) that generate real, harmless observable activity so
you can try SysSight immediately - see
docs/guides/quickstart.md.
cargo run --release -p syssight-benches --bin format-bench
cargo run --release -p syssight-benches --bin correlation-benchActual output from one run on the machine this repository was built on:
syssight-format bench (N = 200000 events)
encode+write: 55.93ms ( 3576020 events/sec)
parse+decode: 27.74ms ( 7210113 events/sec)
capture size: 9400431 bytes (47.0 bytes/event)
syssight-correlation bench (2000 processes x 50 events = 102000 events)
ingest: 56.12ms ( 1817635 events/sec)
Single-run wall-clock numbers on one VM, not a rigorous statistical
benchmark - see docs/development/testing.md#benchmarks
for the full caveats. Re-run them yourself before relying on the exact
figures for anything.
Full, current list: LIMITATIONS.md. Summary:
- The CO-RE eBPF backend is a researched design
(
docs/architecture/ebpf.md) that has never been built or run against a kernel - this project's sandbox had no root/CAP_BPF. The default/proc-polling backend is what's actually implemented, tested, and used by every command. - The polling backend can miss activity that starts and ends between two
polls (default 200ms), and doesn't observe file deletes/renames at all
- both are inherent to polling
/procrather than in-kernel tracing, not bugs.
- both are inherent to polling
syssight-commonandsyssight-tuidon't have dedicated unit tests of their own yet (syssight-tuiis exercised by arender_to_textscreenshot example and manual use instead) - every other crate does, includingsyssight-coreandsyssight-cli, both newly covered in1.0.0(50 tests total:cargo test --workspace).- The new fuzz-lite
.ssrparser test suite is real and found two genuine bugs before release, but it's a fixed-seed stable-Rust suite, not a coverage-guidedcargo-fuzztarget - seedocs/development/stability-policy.md.
The default backend needs no special privileges to monitor your own
processes; monitoring another user's process needs root. SysSight never
executes anything derived from monitored-process data, never modifies
or signals a monitored process, and never sends captured data anywhere
except the .ssr file path you gave it. Full detail, including how
.ssr parsing defends against malformed/malicious input:
docs/architecture/security-model.md.
Found a security issue? See SECURITY.md, not a public issue.
ROADMAP.md - Completed / In Progress / Planned / Future,
kept honest (nothing is marked done that wasn't actually built and
tested).
docs/architecture/- overview, event pipeline, correlation engine, eBPF design + status, security modeldocs/guides/- installation, quickstart, monitoring, recording, replaydocs/development/- building, testing, contributing, stability policy (what1.0.0does and doesn't commit to)docs/format/ssr-format.md- full.ssrbinary format specification
See CONTRIBUTING.md and
CODE_OF_CONDUCT.md. Honesty about what's
implemented vs. designed vs. planned is treated as a hard requirement
for contributions, not a style preference - see
CONTRIBUTING.md's "Honesty is a hard requirement"
section.
Apache License 2.0 - see LICENSE. All direct dependencies
(clap, ratatui, crossterm, serde, serde_json, thiserror,
anyhow, crc32fast, tempfile, libc) are MIT and/or Apache-2.0
licensed, compatible with this project's license.