macOS Network Sentinel

MSAA Copyright © 2026 Liquidsky Network Security. All Rights Reserved.

Real-time network visibility and threat-aware connection monitoring for macOS.

macOS Network Sentinel is a standalone defensive security app for quickly answering what a Mac is talking to, which processes are responsible, which local services are listening, what changed from a baseline, and what evidence should be exported for incident response.

Organization: Liquidsky Network Security
Website: https://liquidskysecurity.com

This first milestone is read-only by design. It uses macOS-native commands and stores evidence locally in SQLite, JSON, CSV, or HTML reports. It does not install kernel extensions, modify firewall rules, block traffic, exfiltrate data, or silently run privileged commands.

• Dark PySide6 desktop GUI with sidebar navigation
• Dashboard summary cards and scan mode selector
• Sortable live connections table with severity values
• Sortable listening services table with exposure and service guesses
• Process detail panel with path, parent PID, signing status, hash, related connections, and guidance
• Process metadata enrichment with parent process, Team ID, SHA256, modified timestamp, and path risk
• Alerts generated by a local rules engine with rule IDs, evidence, recommendations, and severity scoring
• SQLite scan history and named baselines
• Structured baseline comparison tabs for new, removed, and changed connections/listeners plus new external processes
• HTML, JSON, and CSV evidence exports
• Evidence bundle export with HTML, JSON, CSV, metadata, collector warnings, raw command outputs, command manifest, baseline comparison, packet capture metadata, and network configuration
• User process allowlist stored locally in reports/allowlist.json
• Trusted DNS resolver and recent-binary threshold settings stored locally in reports/settings.json
• Optional bounded packet capture workflow using tcpdump only after explicit user confirmation
• Headless CLI for scans, baselines, comparison, and export
• Integration placeholders for Liquidsky Network Security

Screenshots placeholder:

• Dashboard
• Live Connections
• Listening Services
• Alerts
• Baseline Comparison
• Process Detail
• Packet Capture
• HTML Report

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

python -m network_sentinel

Use Run Scan from the toolbar or dashboard. Choose:

• Quick Scan for active network visibility
• Deep Scan reserved for expanded collection
• Baseline Scan to save a trusted snapshot
• Compare Against Baseline to identify new or removed network behavior

python -m network_sentinel.cli scan
python -m network_sentinel.cli baseline create --name clean-install
python -m network_sentinel.cli compare --baseline clean-install
python -m network_sentinel.cli export --format html
python -m network_sentinel.cli export --format json
python -m network_sentinel.cli export --format csv
python -m network_sentinel.cli export --format bundle

The MVP runs read-only macOS commands including:

• lsof -nP -iTCP -iUDP
• lsof -nP -iTCP -sTCP:LISTEN
• ps axo pid=,ppid=,user=,comm=,args=
• ps auxww
• scutil --dns
• route -n get default
• netstat -rn
• netstat -anv
• ifconfig
• networksetup -listallhardwareports
• /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
• /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

Process metadata may use codesign, filesystem metadata, and local SHA256 hashing when paths are available and readable.

Raw command output can be included in evidence bundles under raw_commands/, with command_manifest.json recording command, timestamps, duration, exit code, stderr, output path, and SHA256. This is enabled by default for incident-response defensibility and can be disabled in Settings.

Optional packet capture is isolated in an advanced GUI workflow and must be explicitly invoked. It uses bounded sudo tcpdump only after confirmation, requires a duration, and never runs indefinitely.

All collection and reporting is local to the Mac. Reports and bundles may contain process names, PIDs, command lines, executable paths, local addresses, remote addresses, DNS configuration, interface information, firewall status, host metadata, raw command output, and optional packet captures. Treat exported reports as incident response evidence.

• Country, ASN, and reputation fields are placeholders in the MVP.
• Code signing, Team ID, hashing, and modification timestamps are evaluated when a process path is available and readable.
• Command output formats can vary across macOS releases.
• Packet capture requires explicit user action and may require administrator authorization.
• The tool does not perform automatic blocking.

• Cancellable scan progress
• Richer historical scan browser
• IP/domain reputation provider interface
• Scheduled scan history view
• Packet capture metadata management in evidence bundles
• Shared report schema with Liquidsky Network Security
• Integrations with macOS Persistence Radar, Security Audit Agent, and Live Response Collector