Nightwatch

Nightwatch is a self-reported baseline-driven Linux security monitor built in C++17 that observes system behavior during idle periods and generates explainable reports of suspicious activity. The project was submitted by a single developer, Jean-François Lachance-Caumartin, as part of the OpenAI 2026 hackathon.

The author states that Nightwatch operates passively, does not alter system settings, and uses a calibration period to build a baseline model of normal behavior. It monitors processes, files, network activity, kernel modules, and BPF programs, comparing live observations against this baseline to detect anomalies.

Key claims include:

• The tool runs in the foreground until stopped by Ctrl-C
• It records what happened and highlights behavior worth investigating
• It stores SHA-256 hashes and security metadata for executables and kernel modules
• Reports are securely saved with restrictive permissions
• It includes script-entrypoint integrity monitoring and attribution of network sockets to processes

This analysis is based entirely on self-reported information from the project description. No independent verification or external data is available.

The description states that Nightwatch is a baseline-driven Linux security monitor. It observes:

• Processes
• Executables
• Interpreter-launched scripts
• Direct microphone and webcam device access
• PipeWire capture streams
• Network sockets
• Kernel security posture
• Loaded kernel modules
• BPF programs

The tool creates a calibration period to establish a "protected fingerprinted model" of the computer's expected state. During monitoring, it compares live observations with this baseline and produces "explainable NOTICE and HIGH findings."

It is written in C++17 and builds with GNU Make without third-party libraries. It collects data from Linux /proc and sysfs, uses pw-cli for PipeWire client attribution, modinfo for kernel-module metadata, and bpftool for BPF inventory.

The tool is described as running passively, not terminating processes or altering system settings. When stopped, it prints and securely saves a detailed report.

The author states that Nightwatch began with the question: "can a personal Linux computer watch for suspicious activity while its owner is asleep, without making risky or destructive changes to the system?"

Positioning claims:

• It is an understandable, host-specific monitor
• It runs in the foreground until Ctrl-C
• It records what happened and highlights behavior worth investigating
• It produces explainable findings
• It does not make "risky or destructive changes"
• It uses a baseline-driven approach to detect anomalies

The project's evolution appears to have focused on:

• Adding exact reviewed-executable fingerprints rather than path-only allowlists
• Implementing script-entrypoint integrity monitoring
• Attributing network sockets to processes
• Adding kernel-posture, loaded-module, and BPF-program monitoring
• Completing validation tests with multiple snapshots

The description states that Nightwatch is designed for personal Linux computers. It was built to watch for suspicious activity while the owner is asleep.

The author mentions it was tested on a Dell Latitude 5400, suggesting a desktop or laptop target environment. The tool is described as running in foreground mode and being suitable for "attended and unattended target-system validations."

No specific customer segments, personas, or use cases beyond personal Linux systems are mentioned.

Not evidenced.

The description contains no information about pricing, licensing, monetization strategy, or business model. There is no mention of customers, revenue streams, or commercial relationships.

• Built with C++17 using GNU Make
• No third-party C++ libraries required
• Collects data from Linux /proc and sysfs
• Uses pw-cli for PipeWire client attribution
• Uses modinfo for kernel-module metadata
• Uses bpftool for BPF inventory
• Stores SHA-256 hashes and security metadata
• Reports created with restrictive permissions
• Automated regression tests using safe synthetic data
• Designed to maintain one-second cadence monitoring
• Root execution requires strict ownership, permission, file-size, symlink, timeout, and output-limit checks

The description states that:

• The tool has completed multiple attended and unattended target-system validations
• It was tested on a Dell Latitude 5400
• A 28-minute normal-use validation was completed with 1,589 snapshots, no skipped snapshots, and no kernel/BPF or file-integrity findings
• Automated regression tests were maintained while refining real findings from overnight and normal-use reports
• The tool has been validated through "repeated real-world validation"

However, there is no evidence of external adoption, customers, revenue, or market traction beyond the author's own testing.

Not evidenced.

The description does not mention any competitors, existing solutions in this space, or how Nightwatch compares to other Linux security monitoring tools. No market positioning or competitive differentiation is described.

• Single developer team: Only one person is listed as a member
• No external validation or adoption: The tool has only been tested by the author and not deployed in production environments
• Limited scope: Designed for personal Linux systems, not enterprise or server environments
• No commercial evidence: No revenue, customers, or business model described
• Self-reported testing: All validation is internal and unverified by third parties
• Hackathon project: Submitted to a hackathon, suggesting it may be experimental or incomplete

1. What specific use cases have you identified for Nightwatch beyond personal Linux systems?
2. How does the tool handle false positives in its baseline detection?
3. Have you tested Nightwatch on different types of Linux distributions or hardware configurations?
4. What are your plans for addressing the challenges mentioned, such as distinguishing legitimate system behavior from suspicious activity?
5. How do you plan to scale beyond personal use cases if at all?
6. Are there any specific security compliance requirements that Nightwatch addresses?
7. What is the expected performance impact on systems running Nightwatch continuously?
8. How does Nightwatch handle updates to the baseline when system configurations change?