endpointwatch: endpoint monitoring that explains itself

Overview

endpointwatch is a live-response endpoint monitor for Windows. It watches processes, network connections, and persistence mechanisms, enriches what it finds with VirusTotal and AbuseIPDB lookups, and turns the result into plain-English alerts written by an LLM. It's the maintained alternative in a field of abandoned tools, MIT-licensed and built with Python and psutil.

The problem

Two gaps motivated it. First, the endpoint monitoring tools that used to fill this niche for small operators and homelab owners are largely dead: unmaintained, broken against modern Windows, or quietly turned into paid SaaS. Second, raw endpoint telemetry is noise to the person who has to act on it. A process spawning at 3am from a temp directory is significant, but only if someone connects that dot to the IP it's talking to and knows what either of them means.

How it works

• Watch. Continuously monitors running processes, active connections, and persistence points (services, scheduled tasks, startup entries) using psutil.
• Enrich. Suspicious indicators are checked against VirusTotal and AbuseIPDB, so a new connection to a known-bad IP or a hash with a threat score becomes an explicit fact, not a guess.
• Explain. An LLM layer converts the enriched event into a plain-English alert: what changed, why it matters, and what to check next. No dashboard spelunking required.

Design decisions

• "Maintained alternative" as a position. The category leader is abandoned. The README says so plainly, and the project positions itself as the maintained answer. Users running this class of tool are actively looking for that.
• Python and psutil. The stack is boring on purpose: ubiquitous, auditable, and runnable on any Windows box without a build chain.
• Windows-first. Endpoint monitoring pain is loudest on Windows desktops and servers in small shops. One platform, done properly, beats three platforms done poorly.
• LLM alerts as a feature, not a wrapper. The model isn't bolted on to look modern. It exists because the failure mode of raw alerts is alert fatigue, and plain-English context is the fix. That's the same lesson from my incident-response work: an alert that explains itself gets acted on.
• MIT license. Security tooling should be readable and reusable. Licensing it openly is part of the trust story.

Result

A self-hosted, zero-cloud endpoint monitor that turns raw telemetry into decisions. It runs on the same philosophy as the rest of my tooling: collect everything, decide what matters, tell the person who can act.