Silent Mac security monitor
Detects unauthorized changes to your system — before you notice them.
GhostWatch is a lightweight macOS menu bar application that continuously monitors critical system settings and alerts you when something changes. It runs silently in the background and notifies you if an app, script, or attacker modifies your security configuration.
No account required. No data sent anywhere. Everything stays on your Mac.
| Category | What it watches |
|---|---|
| Launch Services | LaunchAgents & LaunchDaemons (persistence mechanisms) |
| Login Items | Apps that start at login |
| Hosts File | DNS overrides in /etc/hosts |
| System Security | SIP status, Secure Boot, FileVault |
| Privacy Permissions | Camera, microphone, screen recording (TCC database) |
| Network Configuration | DNS servers and proxy settings |
| Firewall | macOS firewall status and rules |
| Scheduled Tasks | Cron jobs |
| Configuration Profiles | MDM and configuration profiles |
| Browser Extensions | Chrome, Firefox, Edge, Brave, Arc extensions |
| System Extensions | Kernel and system extensions |
| Applications | App installs, removals, and version updates |
| SSH Keys | Authorized keys and key files in ~/.ssh |
| User Accounts | Local user accounts |
| Sharing Preferences | Remote Login, Screen Sharing, File Sharing |
| XProtect | Apple's built-in malware definitions version |
- Real-time event timeline with severity indicators (Info / Warning / Critical)
- Filter by category, severity, date range (Today, 3 days, 7 days, 30 days, All)
- Full-text search across events
- Bookmark and dismiss events
- Statistics with charts (7-day trend, category distribution, top apps)
- Export to JSON, CSV, or HTML
- Menu bar integration with recent events overview
- macOS native notifications
- Bilingual: English and French
- Automatic data retention policy (configurable)
- Lightweight — minimal CPU and memory usage
Dashboard — event timeline with filters and severity indicators
Menu bar Monitor settings
About
- Download the latest
.dmgfrom the Releases page - Open the
.dmgfile - Drag GhostWatch to your Applications folder
- Launch GhostWatch from Applications
GhostWatch needs specific macOS permissions to monitor your system effectively. On first launch, you'll be guided through the setup, but you can also configure them manually:
Required to read the TCC privacy database and monitor all LaunchAgents/Daemons.
- Open System Settings > Privacy & Security > Full Disk Access
- Click the + button
- Navigate to
/Applications/GhostWatch.appand add it - Restart GhostWatch
Required to receive alerts when changes are detected.
- Open System Settings > Privacy & Security > Notifications
- Find GhostWatch and enable notifications
- Recommended: set alert style to Alerts for persistent notifications
You can check your permission status at any time in Settings > Permissions.
- Quit GhostWatch from the menu bar
- Delete
GhostWatch.appfrom Applications - Optionally remove app data:
rm -rf ~/Library/Application\ Support/GhostWatch
- macOS 14.0 (Sonoma) or later
- Apple Silicon or Intel Mac
- ~20 MB disk space
Does GhostWatch send data to the internet? No. GhostWatch is 100% offline. All data stays on your Mac in a local database.
Does it slow down my Mac? No. GhostWatch uses polling intervals between 30 seconds and 5 minutes depending on the monitor, and file system events for real-time detection. CPU usage is negligible.
Can I disable specific monitors? Yes. Go to Settings > Monitors and toggle any monitor on or off. Each monitor has an info button explaining what it does.
Where is the data stored?
In ~/Library/Application Support/GhostWatch/. You can configure automatic cleanup in Settings > General > Data Retention.
Why does it need Full Disk Access? Some system databases (like the TCC privacy database) are protected by macOS. Full Disk Access lets GhostWatch read these files to detect permission changes. GhostWatch never modifies any system file.
If you find GhostWatch useful, you can support its development:
GhostWatch is freeware. Free to use for personal and commercial purposes. Source code is not available. See LICENSE for details.
Developed by Florian Bertaux
© 2026 Florian Bertaux. All rights reserved.