sysai

sysai watches operating system activity through the lowest interface each platform offers, using eBPF on Linux, the Endpoint Security Framework on macOS, and ETW on Windows, then reasons about what it sees with an LLM. It answers questions about the running machine in plain language, such as which processes spawned in the last minute or whether anything is connecting to external addresses, and it can carry out tasks like scanning local ports. A monitor mode watches continuously and raises alerts on suspicious activity, for example a process running from a temporary directory under a hidden name. The provider and model are selectable at the command line rather than fixed.

Technologies Used

Go

eBPF

Docker