PkgFoundry
Catalog PyPI
Back to packageRELEASE DETAILS

0.2.3

PyPI

aientrophy-nightwatch

Real-time file monitoring agent with YARA scanning and AI-powered malware analysis

antivirusfile-monitoringmalwaresecurityyara
Published20 Mar 2026
Direct dependencies14
Transitive dependenciesNot calculated

README

Version 0.2.3 documentation

Aientrophy Nightwatch

Real-time file monitoring agent with YARA scanning and AI-powered malware analysis.

Features

  • Real-time file monitoring — watchdog-based filesystem watcher with event deduplication
  • Multi-layer scanning pipeline — Hash DB → Extension mismatch → YARA rules → Cloud AI
  • YARA rule engine — Compiled rule matching with auto-update from cloud
  • Extension disguise detection — Detects executables/scripts masquerading as images/documents
  • Quarantine management — Automatic isolation with metadata tracking and restore capability
  • Cloud AI analysis — Escalates suspicious files to Claude API for deep inspection
  • Lightweight agent — ~50MB RAM footprint, all heavy analysis offloaded to cloud

Quick Start

# Install
pip install aientrophy-nightwatch

# Scan a single file
nightwatch scan /path/to/suspicious/file

# Start monitoring daemon
nightwatch start --config /etc/aientrophy/agent.yml

# Check status
nightwatch status

One-line Server Install

curl -sL https://install.aientrophy.com/agent | sudo bash -s -- --key YOUR_API_KEY

Configuration

watch:
  paths:
    - /var/www
    - /tmp
  recursive: true

scan:
  yara_rules_dir: /var/lib/aientrophy/yara-rules
  hash_db_path: /var/lib/aientrophy/hash-db/malware_hashes.txt

action:
  on_detect: quarantine  # quarantine | alert | block

cloud:
  server: https://malware.aientrophy.com

Requirements

  • Python 3.10+
  • Linux (recommended) or Windows

Links

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 20

Native requirements
14 direct targetsNot calculated transitive count
Package / targetRequirementRelationship
watchdog
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
watchdog>=4.0runtime
httpx
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
httpx>=0.27runtime
pyyaml
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
pyyaml>=6.0runtime
click
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
click>=8.1runtime
rich
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
rich>=13.0runtime
yara-python
Environment
{
  "extras": "",
  "marker": "extra == \"yara\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
yara-python>=4.5; extra == "yara"runtime
python-magic
Environment
{
  "extras": "",
  "marker": "extra == \"magic\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
python-magic>=0.4; extra == "magic"runtime
fastapi
Environment
{
  "extras": "",
  "marker": "extra == \"cloud\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
fastapi>=0.115; extra == "cloud"runtime
uvicorn
Environment
{
  "extras": "",
  "marker": "extra == \"cloud\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
uvicorn>=0.32; extra == "cloud"runtime
anthropic
Environment
{
  "extras": "",
  "marker": "extra == \"cloud\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
anthropic>=0.40; extra == "cloud"runtime
python-multipart
Environment
{
  "extras": "",
  "marker": "extra == \"cloud\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
python-multipart>=0.0.12; extra == "cloud"runtime
pytest
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
pytest>=8.0; extra == "dev"runtime
pytest-asyncio
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
pytest-asyncio>=0.24; extra == "dev"runtime
ruff
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
ruff>=0.8; extra == "dev"runtime
yara-python
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
yara-python>=4.5; extra == "all"runtime
python-magic
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
python-magic>=0.4; extra == "all"runtime
fastapi
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
fastapi>=0.115; extra == "all"runtime
uvicorn
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
uvicorn>=0.32; extra == "all"runtime
anthropic
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
anthropic>=0.40; extra == "all"runtime
python-multipart
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.10",
  "evaluation": "NOT_EVALUATED"
}
python-multipart>=0.0.12; extra == "all"runtime

Distribution files

2 collected
aientrophy_nightwatch-0.2.3-py3-none-any.whl

bdist_wheel · 34.42 KB · Python py3

Source file
aientrophy_nightwatch-0.2.3.tar.gz

sdist · 36.24 KB · Python source

Source file

Metadata history

Meaningful changes
Current collected state Current

Observed since 21 Oct, 10:39 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package_version:e07cab226c4ff718ac283b3fb2a0ee6ec33b0feb22223e4b52facb0fd52944ac

Other collected versions

View all collected versions →