A self-contained SIEM + HIDS + Digital Forensics tool for Windows. Real-time threat detection, AES-256 evidence storage, automated response — zero servers required.
Every collector, detection rule, and response action designed to work together on a single Windows endpoint.
Simultaneous telemetry: Auth events, Process behavior, Network flows, File-system changes, and Browser artifacts — all running concurrently.
Rule-based User & Entity Behaviour Analytics. Covers brute-force, masquerade processes, obfuscated PowerShell, ransomware patterns and more.
SQLCipher AES-256-CBC at rest. Ed25519-signed commands. PBKDF2-SHA256 passwords with 150,000 iterations. Forensic-grade integrity.
In auto-mode, WYPE queues Ed25519-signed commands: suspend process, block IP (900s), disable USB — all within seconds of detection.
AES-256 encrypted archives pushed to Google Drive or SMTP. Full forensic recovery after system rebuild. Essential for post-incident analysis.
Microsecond-precision UTC reconstruction. Cross-stream event correlation via agent identity. Admissible chain-of-custody standards.
From OS telemetry all the way to the Electron dashboard — every layer is designed to run locally, with no cloud dependency.
Desktop dashboard with real-time event feed, alert triage, forensic timeline, and operator settings — REST to localhost only.
Detection engine, UEBA rule evaluation, risk scoring. AES-256 encrypted SQLite. JWT HS256 sessions with TOTP 2FA.
Multi-threaded collector. Reads Security Event Log, enumerates processes, monitors network and file system, extracts browser artifacts.
37+ Security Event IDs, Sysmon process records, WMI device events. Full Windows telemetry surface instrumented.
| Feature | WYPE | Wazuh | Splunk | ELK |
|---|---|---|---|---|
| Server-free deployment | ||||
| Real-time alerting | ||||
| Automated response | ||||
| Encrypted storage (AES-256) | ||||
| Cloud log backup | ||||
| Digital forensics | ||||
| TOTP 2FA | ||||
| Zero cost (core) | ||||
| CPU footprint | <5% | 15–30% | 20–40% | 20–50% |
| Deploy time | Minutes | Hours | Days | Days |
Results measured on Intel i5-10400 · 16 GB RAM · Windows 10 22H2.
Portable, server-free, and ready in minutes. No cloud account required for core functionality.
Includes all 5 collectors, 38-rule UEBA engine, AES-256 encrypted database, automated response, cloud backup, and forensic timeline.
WYPE ships with a full Electron-based desktop dashboard — real-time alert feed, forensic timeline viewer, risk score chart, and incident response panel. All data stays local on your machine. The dashboard opens automatically on localhost:8000 after the backend starts.
Department of Information and Communication Engineering
WYPE is free, portable, and ready to deploy in minutes. No server, no cloud subscription, no expertise required.