Endpoint Health Automation & Security System
A Python-based Windows endpoint monitoring and security utility that tracks system health, platform and CPU information, resource utilization, processes, and open/listening ports. Includes baseline comparison, change detection, alerts, event logging, scheduled execution, configuration management, and structured JSON/TXT reporting.
The Problem
I wanted a practical way to understand what a Windows machine is doing at any given moment — how hard the CPU and memory are working, what processes are running, and which network ports are open or listening. Rather than relying on scattered built-in tools, I wanted a single, repeatable utility that could capture a consistent snapshot of endpoint health and flag anything that changed between runs.
My Approach
I built a Python-based monitoring and security utility using Python 3.12 and its system and network libraries. The tool collects system health, platform and CPU information, and resource utilization, then enumerates open and listening ports and the processes behind them. It keeps a baseline of a known-good state and compares each new scan against it, so changes in the endpoint or network state surface as alerts instead of being silently missed.
What I Built
System health monitoring — Tracks platform, CPU, memory, and disk utilization to give a clear picture of endpoint state.
Port and process analysis — Enumerates open and listening ports along with their owning processes, exposing the network surface of the machine.
Baseline comparison & change detection — Stores a reference baseline and highlights differences between runs, so new listeners or changed state stand out.
Alerts, event logging, and reporting — Generates alerts and event logs, and writes structured JSON/TXT reports that are easy to read and to feed into other tooling.
Configuration & scheduling — Reads configuration and supports scheduled execution for repeatable, hands-off monitoring.
Web dashboard planned for V2.
What I Learned
Building this reinforced how much sits behind “endpoint visibility” — process enumeration, port ownership, baseline drift, and structured output all have to work together to make a monitoring tool genuinely useful. Writing it in Python with a clean separation between collection, comparison, and reporting made each layer testable and easy to extend.