Observed arrival · 2026-11-08
Hostwatch turns Mac activity into attack stories
Hostwatch is a downloadable macOS intrusion-detection app that says it links related activity into a readable timeline and can pause unfamiliar network connections for a decision.
- For
- Mac users who want to inspect suspicious activity
- Worth noticing
- The page gives commands to check the app’s notarization and compare its download against a published SHA-256 checksum.
Field notes
Hostwatch says its first hour establishes a baseline, then groups related process, file, and network events into scored “stories,” with commands, files, or addresses available from a timeline. Its optional Ask mode pauses a program’s new outbound connection for an allow/block decision, using macOS’s pf firewall; the page says traffic is not decrypted. The download is listed for macOS 26 or later on Apple silicon and Intel, and the project links to source and release checksums.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue