automation · July 2026
Sentinel
A local Windows privacy watchdog: it watches sensitive folders, clipboard access, and process-creation chains — no cloud, no admin rights — and an IsolationForest scores each event for anomaly. High scores surface as alerts for a human to judge; nothing is auto-blocked without you.
Tornike Kalandadze — software engineer & technical lead, client delivery since 2019 · Tbilisi (GMT+4)
Problem
Knowing what touches your files and clipboard on Windows means either trusting a cloud EDR with everything or flying blind. There was no local-only answer that runs without admin rights and keeps the data on the machine.
Approach
Watch, score, and defer to the human. Native Windows APIs feed an event stream into SQLite; a Python IsolationForest scores each event on rate, actor novelty, target sensitivity, and time-of-day, bootstrapped by a deterministic synthetic baseline so day one isn't noise. The ML path is optional by design — no Python, and scoring falls back to C# rules. Alerts are a gate, not a trigger: the watchdog flags, the human decides.
Impact
A working anomaly pipeline with honest limits, stated up front: foreground-window attribution is a heuristic, the watchdog runs only while the dashboard is open, storage is unencrypted. What it proves is the full loop — raw OS events to ML scores to a ranked, sparkline-backed dashboard — entirely local, zero cloud, zero admin.
Through every lens
04 · Automation
An always-watching pipeline with a human gate at the end: events stream from Windows APIs through IsolationForest scoring, and anything ≥80 raises an alert that waits for human review — detection is automated, judgment is not.
05 · Security
Privacy monitoring that respects privacy: clipboard events log the actor and payload shape, never contents; everything stays in local SQLite; core function needs no admin rights.
06 · AI
scikit-learn IsolationForest over four engineered features (event rate, actor novelty, target sensitivity, time-of-day), warm-started by a deterministic synthetic baseline — with a rule-based C# fallback when Python isn't there.
Built with
C# / .NET 8 · WPF · Python · scikit-learn (IsolationForest) · SQLite (WAL) · Windows APIs (WMI, ReadDirectoryChangesW)
Notes
Everything stays on the machine. A C#/.NET 8 core taps ReadDirectoryChangesW, WMI, and clipboard listeners to watch what touches your Documents, .ssh, and browser profiles, who reads the clipboard (payload shape only — contents never logged), and which process spawned which. Events land in SQLite (WAL mode) and flow through a Python IsolationForest scoring four features: event rate, actor-process novelty, target sensitivity, and time-of-day. A deterministic synthetic baseline makes detection meaningful from first run, and if Python is missing the engine degrades gracefully to C# rule-based scoring. The WPF mission-control dashboard shows a severity-coded live feed, ranked offender processes with sparkline histories, reconstructed parent-child process chains, and a lockdown toggle — anomalies scoring ≥80 raise a toast and wait for the human to decide. A demo mode replays synthetic attack scenarios for testing.