ShadowSense AIFind out when traffic on your network starts to look like an attack
ShadowSense AI watches the connection records from your computer or your network, labels each one with a machine-learning model, and opens an alert when something looks like a scan, a brute-force attempt, a flood or botnet behaviour.
There is no separate sign-up form. Sign in with Google or an emailed code and your account is created the first time.
- Metadata onlyNever page contents or files
- Windows, macOS, LinuxOne small agent per computer
- Private by accountYou see only your own computers
| Time | Source | Destination | Prediction | Severity |
|---|---|---|---|---|
| 14:02:11 | 10.0.0.5 | 10.0.0.9:22 | bruteforce | high |
| 14:02:04 | 10.0.0.31 | 10.0.0.9:80 | dos | high |
| 14:01:58 | 10.0.0.66 | 10.0.0.4:445 | scan | medium |
| 14:01:57 | 10.0.0.12 | 10.0.0.2:443 | benign | none |
What you get
A dashboard that shows what your computers and network are doing, and tells you when something needs a look. You decide what to do next.
Live flow collection
A small agent on your computer, or Zeek logs from a whole network. New flows show up on the dashboard within seconds.
Classification
A trained model labels each flow as normal, scan, brute force, denial of service or botnet-like.
Severity you can read
Severity comes from a short, documented rule table and not from the model’s score, so you can always see why something is rated high.
Fewer duplicate alerts
Repeated events from one source are grouped into a single alert, with a cooldown so a long attack does not flood you.
Email alerts
Get an email when an alert opens at medium severity or above. Failed deliveries are retried.
Investigation tools
Open an alert to see its related flows and history. Team members with analyst access can acknowledge or resolve it and add notes.
Your own computers
Add up to five computers per account by default, see which are online, and remove one at any time to cut off its token.
Controlled access
Sign in with Google or an emailed code. Roles limit who can change alerts, and administrator actions are logged. Questions go to the Support tab inside the app.
From a network connection to an alert
Every connection goes through the same five stages.
- RecordThe agent or Zeek writes one record for every connection: who talked to whom, on which port, how much, for how long.
- ClassifyThe model predicts a class for each record and keeps its confidence score.
- RateA rule table sets the severity from the class and the port that was targeted.
- AlertMedium severity and above opens an alert. Repeats from the same source are grouped.
- InvestigateYour team reviews the related flows, adds notes and closes the alert.
What it detects
Each flow gets one of these labels. The severity shown is the default and goes up by one step when the target is a sensitive port.
| Label | What it usually looks like | Default severity |
|---|---|---|
| Benign | Ordinary browsing, streaming, software updates and mail. | None |
| Scan | One source probing many ports or hosts to find out what is open. | Low |
| Brute force | Many quick login attempts against one service, such as SSH or remote desktop. | Medium |
| Denial of service | A burst of connections or packets aimed at one target to overwhelm it. | High |
| Botnet-like | Regular, repeated calls from a machine to outside hosts, the way an infected machine checks in. | High |
Sensitive ports are FTP (21), SSH (22), Telnet (23), SMB (445) and Remote Desktop (3389). Alerts open at medium severity and above by default.
Two ways to bring in traffic
Use the one that matches what you want to watch.
Your own computer
Install the ShadowSense agent on a laptop or desktop you own. It works on Windows, macOS and Linux, sends flow metadata every few seconds, and the traffic appears under your account.
- Create a token for each computer on the setup page.
- Run the agent as administrator or with sudo, because capturing packets needs those rights.
- Remove the computer on the setup page to stop it for good.
A whole network
Run Zeek on a sensor machine and send its connection log to ShadowSense AI with the forwarder script that ships with the project.
This uses the server operator’s access key, so it is set up by the team that runs the server rather than from a user account.
Connect a computer in four steps
It usually takes about ten minutes the first time, most of it installing Python and the capture driver on Windows.
- Create an accountSign in with Google or an emailed code. A new email gets an account automatically.
- Create a tokenOpen Connect your computer, name the computer and create a token. It is shown once, so copy it straight away.
- Run the agentDownload it, then run the command from the setup page as administrator or with sudo. Windows also needs Python and Npcap.
- Watch the dashboardBrowse as usual. Live events fill in within a few seconds and the computer shows as online.
Sample output on Linux or macOS
$ sudo python3 shadowsense_agent.py \ --server https://shadowsenseai.in --token ssd_•••••••• ShadowSense agent: capturing flow metadata (no payloads) and sending it to https://shadowsenseai.in. Press Ctrl+C to stop. raw_seen=412 packets=398 sent=36 queued=0 dropped=0 raw_seen=977 packets=951 sent=121 queued=0 dropped=0
What leaves your computer, and what does not
A website cannot see your traffic, which is why the agent runs on your side. It is built to send as little as possible.
Sent to ShadowSense AI
- Source and destination IP addresses
- Ports and protocol
- Byte and packet counts
- When each connection started and how long it lasted
Never read and never sent
- Web pages and URLs
- Files and downloads
- Messages and passwords
- Packet payloads of any kind
- Private by account. Data from your computers is visible only to your account.
- Kept for 30 days by default. Older events are deleted automatically.
- Easy to revoke. Remove a computer and its token stops working immediately.
- No ads, no selling. Read the privacy policy for the full list.
Questions
Do I have to install something?
Yes. A website cannot see the traffic on your computer, so a small agent runs there, much like an antivirus does. Linux needs only Python 3. macOS needs Python 3 and scapy. Windows needs Python, scapy and Npcap.
Why does the agent need administrator rights?
Capturing network packets is a privileged action on every operating system. The agent only counts and groups connections. It does not read what is inside them.
Can ShadowSense AI see my browsing or messages?
No. It records which address connected to which, on which port, and how much data moved. It never receives page contents, URLs, files or passwords.
How many computers can I add?
Up to five per account by default. You can remove one at any time and add another.
How do I stop monitoring a computer?
Press Ctrl+C in the agent’s window to pause it. To stop it permanently, remove the computer on the setup page, which makes its token useless.
Is it always right?
No. Detections are statistical predictions and can be wrong, especially on traffic the model has not seen before. Use ShadowSense AI alongside your other security controls.
Does it block attacks?
No. It detects and alerts, and people decide what to do next.
Which networks and computers can I monitor?
Only ones you own or have explicit permission to monitor.
Who can see my dashboard?
Anyone can create an account and sees the data from their own computers. Network-wide data and administration are limited to approved team members.
Create your account and add your first computer
It takes a few minutes. Use Google or an emailed code.