How rapabru/terminal-ephemeral-analyzer works
Terminal Ephemeral Analyzer is a Windows process-monitoring and review tool focused on capturing short-lived processes without polling. Its workflow is Security Event Log capture, lifecycle pairing, risk scoring, secret redaction, persistence and alerting, followed by background signature/hash enrichment and dashboard review. The dashboard is static and offline; management CLIs update live-read configuration and whitelist files. Relationships reflect README documentation and sampled code; some monitor and dashboard internals were only partially excerpted, so uncertain wiring is omitted.
Main entry points: monitor.py Lifecycle monitor · enrichment.py Enrichment worker · heuristics.py Risk heuristics · db.py SQLite persistence
Components 19
Capture and scoring
- Lifecycle monitor
monitor.py - Risk heuristics
heuristics.py - Secret redaction
redact.py
Enrichment and alerts
- Enrichment worker
enrichment.py - VirusTotal client
vt_client.py - Alert delivery
alerts.py
Local state
- SQLite persistence
db.py - Configuration
config.py - Whitelist rules
whitelist.py
Review and management
- Config manager
config_manage.py - Whitelist manager
whitelist_manage.py - Static dashboard
dashboard.py
System integrations
- Windows Security Events
- Signature verification
codesign.py - PowerShell
- VirusTotal API
- Windows notifications and Event Log
Other components
- Operator
- Browser
Connections 29
- Windows Security Events → Lifecycle monitor: pushes events
- Lifecycle monitor → Whitelist rules: classifies processes
- Lifecycle monitor → Configuration: reads settings
- Lifecycle monitor → Risk heuristics: scores events
- Risk heuristics → Configuration: reads thresholds
- Risk heuristics → SQLite persistence: checks activity
- Risk heuristics → Signature verification: checks signature
- Signature verification → PowerShell: runs verification
- Lifecycle monitor → Secret redaction: redacts for storage
- Lifecycle monitor → SQLite persistence: stores events
- Lifecycle monitor → Alert delivery: triggers alerts
- Lifecycle monitor → Enrichment worker: queues event
- Enrichment worker → Risk heuristics: checks signature
- Enrichment worker → Configuration: reads settings
- Enrichment worker → VirusTotal client: requests lookup
- VirusTotal client → SQLite persistence: reads and writes cache
- VirusTotal client → VirusTotal API: queries hash
- Enrichment worker → SQLite persistence: updates verdict
- Enrichment worker → Alert delivery: alerts on escalation
- Alert delivery → Windows notifications and Event Log: notifies and logs
- Static dashboard → SQLite persistence: reads events
- Static dashboard → Risk heuristics: labels LOLBins
- Operator → Lifecycle monitor: runs monitor
- Operator → Config manager: manages settings
- Config manager → Configuration: updates settings
- Operator → Whitelist manager: manages whitelist
- Whitelist manager → Whitelist rules: updates rules
- Operator → Static dashboard: generates dashboard
- Static dashboard → Browser: opens report