Overwatch

Inspiration

We built Overwatch because local security signals are usually too noisy and too fragmented to act on quickly. File events, process activity, network behavior, and runtime errors all exist in separate places, but the important patterns are easy to miss when they are not connected. We wanted a practical, local-first triage system that could combine those signals, reduce noise, and surface high-risk activity in a way that is actually usable day to day.

## What it does

Overwatch is a macOS security triage and alerting system.

It:

• monitors file and process activity
• queues events for scoring
• uses a triage daemon to assign risk levels
• flags high-risk events for immediate alerts
• sends notifications through configured channels
• can use local LM Studio-backed scoring
• includes network monitoring and log monitoring
• supports operational cleanup, including unloading and shutting down the model runtime

The goal is to turn raw machine activity into actionable security alerts without forcing the user to babysit the system.

## How we built it

We built Overwatch as a set of small Python services and macOS launchd jobs.

The pipeline is roughly:

1. FileMonitor and ProcessMonitor generate events.
2. Events are written into a queue.
3. triage_daemon.py reads the queue and scores each event.
4. lmstudio_manager.py manages local model loading and shutdown.
5. alerter_daemon.py sends alerts for high-risk events.
6. network_monitor.py detects suspicious network behavior.
7. log_monitor.py checks the system’s own logs for failures and sends alerts.
8. launchd plists keep the system running on a schedule.

We also added documentation and integration summaries so the project is easier to understand, test, and submit.

## Challenges we ran into

The biggest challenge was balancing sensitivity and noise. Security tools are only useful if they catch real problems without flooding the user with false positives.

Some of the harder issues were:

• filtering out routine system activity
• preventing duplicate alerts
• cleaning up model/runtime state correctly
• handling failures in LM Studio or other dependencies
• keeping the whole system local and lightweight
• making the alert flow stable enough for continuous use

## Accomplishments that we're proud of

We’re proud that Overwatch is not just a script, but a working end-to-end triage pipeline.

We also consider it a win that the project:

• combines multiple activity sources into one workflow
• produces actionable alerts instead of raw logs
• includes network and log monitoring in addition to file/process triage
• manages local model runtime state cleanly
• remains self-contained and reproducible on macOS

## What we learned

This project taught us that security automation works best when it is layered.

No single source of truth is enough. File activity, process behavior, network anomalies, and internal failures each reveal different parts of the story. The useful system is the one that combines them without becoming fragile.

We also learned that operational details matter a lot. A triage system is only trustworthy if the model runtime, daemons, logs, and cleanup behavior are all handled carefully.

## What's next for Finbot

If you meant Overwatch, this section should be:

## What's next for Overwatch

Next, we want to improve:

• alert quality and risk calibration
• event schema consistency
• dashboarding and triage history
• support for additional security data sources
• evaluation of false positives and detection accuracy
• cleaner packaging for easier setup and submission

Built With

• filemonitor
• launchd
• lm
• macos
• openclaw
• processmonitor
• python
• studio
• velociraptor
• yara