Can a host watch itself closely enough that an LLM analyst catches the attack before the irreversible action?

Crypto infrastructure — validators, signers, bridge nodes — has an unusual property: the damage is final the moment a key is used. Detection after the fact is not detection. Vigilo is an OS-level daemon that watches file access, process spawns, and network connections in real time, and pairs a one-second alert path with a slower LLM pass that correlates event sequences into attack patterns.

Cheap host-level collection plus a slower correlating LLM pass will catch multi-step attack chains that per-event rules structurally cannot, with overhead low enough to run on a signer and an alert volume low enough that operators keep reading it.

• Key exfiltration: a private key or keystore is read by a process that has no business reading it, then leaves the host
• Remote code execution: a shell spawned from an application runtime (node, python) as the first foothold
• Supply-chain compromise: a package install initiated by a running application process rather than a deploy
• Privilege escalation from an application process toward root
• Coordinated campaigns: the same sequence appearing across several monitored hosts, invisible to any single host's rules
• Out of scope: kernel-level rootkits that defeat /proc and inotify, and physical or hypervisor-level compromise

• Go daemon: fsnotify file watcher, /proc process poller, /proc/net connection poller, suppression rules
• SQLite event buffer with a signal-dedup table, so repeated noise does not become repeated pages
• Two-tier alerting: immediate push (Slack, Telegram, email, generic webhook) for high/critical events
• MCP server on :7070 exposing five tools, so the analyst reads events as a first-class interface rather than scraping logs
• TypeScript analyst agent: multi-daemon aggregation, context compaction, inspector-and-retry loop, running every five minutes

• Tier one — immediate: single events with an unambiguous signature (keystore read by an unfamiliar process, secret written to a world-readable path) page in about a second
• Tier two — correlated: the analyst reads a five-minute window and looks for shapes, not strings — read-then-connect, spawn-then-install, repeat-across-hosts
• Severity is assigned by irreversibility, not by rarity: anything touching signing material is critical regardless of frequency
• Suppression is explicit and configured per host, so known-noisy legitimate processes do not train operators to ignore the channel
• Dedup keys collapse repeated identical signals into one page with a count
• The analyst never acts: its output is an explanation and a severity, and every conclusion cites the events it rests on

• Single Go binary per host, no agent framework; state is one SQLite file
• Collection by polling /proc and /proc/net plus inotify on watched paths — deliberately portable ahead of an eBPF path
• MCP server is the only read interface; the analyst has no log-scraping fallback, which keeps the event schema honest
• Analyst runs off-host on a five-minute cadence, aggregating several daemons and compacting context before each pass
• Alert transports are pluggable: Slack, Telegram, email, generic webhook

The interesting comparison is not detection rate in isolation — it is whether the five-minute correlation window catches chains that per-event rules structurally cannot, without drowning the operator in the process.

• Polling misses short-lived processes that start and exit between /proc samples
• A legitimate deploy that installs packages from an app process looks exactly like a supply-chain event
• Under heavy event volume the analyst's context compaction drops the very events that made a chain legible
• Suppression rules written during an incident are rarely removed afterwards, quietly widening blind spots

• Linux-only: collection depends on /proc and inotify semantics
• Single-host SQLite buffer; cross-server correlation happens in the analyst, not the storage layer
• The LLM analyst is a detection aid, not a control — it does not block anything
• False-positive characterisation is anecdotal so far, not measured over a long window

Daemon and analyst both running. Immediate tier fires in roughly a second; the analyst correlates on a five-minute cadence. Detection catalogue covers key reads, secret writes, RCE-shaped spawns, exfiltration chains, privilege escalation, and cross-host repeats.

• eBPF collection to replace polling where the kernel allows it
• Signed event chains so the buffer itself is tamper-evident
• Response hooks: quarantine and key-rotation triggers behind human approval

• Where the boundary sits between detection and structural prevention on an irreversible action
• How much host context an LLM analyst needs before correlation beats a hand-written rule
• Suppression as a learned rather than configured behaviour