evilsocket/opensnitch

Features

• Firewalls - Monitors and intercepts outbound network connections, prompting users to allow or deny traffic per process.
• Application Access Controls - Prompts for user approval before allowing applications to establish network connections.
• Network Access Control - Restricts network access for specific processes by prompting for user approval or applying rules based on executable paths.
• Outbound Network Blockers - Hooks kernel functions to monitor and capture connection details for all processes to prevent unauthorized data transmission.
• Traffic Filtering - Configures granular filtering for network connections by specifying executable paths, destination hosts, and ports.
• Traffic Monitoring Tools - Provides real-time monitoring and logging of outbound network traffic mapped to specific local processes.
• Distributed Firewall Orchestration - Enables centralized management and monitoring of security policies across multiple distributed network nodes.
• Distributed Policy Management - Manages security policies across multiple distributed nodes from a single, unified dashboard.
• Firewall Configurations - Provides a graphical interface to list, edit, and perform batch operations on traffic filtering rules.
• Firewall Policies - Manages and monitors network security rules across multiple distributed nodes from a single unified dashboard.
• Kernel Networking Hooks - Hooks into kernel-level interfaces to intercept and capture system-wide network connection attempts in real time.
• Secure Node Networking - Encrypts network traffic between distributed nodes using security certificates to prevent unauthorized interception.
• Security Policy Management - Provides a centralized dashboard for managing firewall rules and security policies across multiple distributed network nodes.
• Alerting Systems - Alerts users to new or unauthorized connection attempts in real time.
• Real Time Process Monitors - Tracks and displays real-time system events and network behavior associated with specific running applications.
• Security Logging and SIEM - Application firewall for GNU/Linux systems.
• Network Security and Proxies - Interactive application firewall for Linux.
• Security And Forensics - Application firewall for monitoring network connections.
• Traffic Filtering Rules - Matches network connection requests against prioritized user-defined policies based on process paths and destination endpoints.
• Runtime and Process Isolation - Requires individual authorization for every process and subprocess to prevent unauthorized network permission inheritance.
• Domain Blocklists - Supports blocking outbound connections based on external lists of domains, IP addresses, and file hashes.
• Binary Integrity Verification - Validates the checksum of an application to prevent unauthorized or modified binaries from establishing connections.
• Network Traffic Analyzers - Tracks and logs real-time system-wide network activity, mapping connection attempts to specific local processes.
• System Activity Monitoring - Observes and logs real-time network socket activity and process behavior to identify suspicious communication patterns.
• Client Connection Inspections - Provides a real-time view of current network sockets and associated node activity to offer visibility into communication states.
• Temporary Access Rules - Allows setting expiration durations for rules to permit specific network connections only for a limited time.
• Process Environment Filtering - Prevents or permits network connections based on process environment variables to mitigate malicious activity like library injection.
• Path Access Restrictions - Restricts network access for executables running from temporary directories or other untrusted locations.
• Event Monitoring Systems - Streams intercepted network connection events to external logging systems for centralized security analysis.
• Security Audit Logs - Streams intercepted network connection events to external management systems for centralized analysis and auditing.
• Network Policy Enforcement - Applies global allow or deny actions to handle network requests when no specific rule matches.
• Log Querying - Enables filtering and searching of connection logs using criteria based on process metadata and network endpoints.
• Background Daemons - Runs a background service that evaluates intercepted connection events against persistent rule sets to determine traffic access.
• Rule Priority Logic - Evaluates network access policies based on explicit priority flags to determine whether to permit or reject connection attempts.

Star history