Continuous local security monitoring daemon for Linux and macOS. Detects brute-force attacks, malware, privilege escalation, suspicious processes, file tampering, cryptominers, and network anomalies using YARA, Sigma, and custom detection rules. Runs as a background process and alerts only when real threats are found. Use when the user wants host-level intrusion detection, security monitoring, threat scanning, or asks about suspicious activity on their machine.

适用于 Linux 和 macOS 的持续本地安全监控守护进程，通过 YARA、Sigma 和自定义检测规则，检测暴力破解攻击、恶意软件、权限提升、可疑进程、文件篡改、挖矿程序和网络异常。作为后台进程运行，仅在发现真实威胁时发出警报。适用于用户需要主机层入侵检测、安全监控、威胁扫描或询问机器上可疑活动的场景。