ReefWatch 🪸
What it does
ReefWatch is a lightweight host-based intrusion detection system (HIDS) that runs as a background daemon on the same machine as OpenClaw. It continuously monitors the local system for security threats and alerts the user through OpenClaw's messaging channels ONLY when something suspicious is detected.
Architecture
ReefWatch runs as an
independent Python process (not consuming LLM tokens) and communicates with OpenClaw via the local webhook endpoint (
/hooks/wake) to alert the user.
CODEBLOCK0
Detection Engines
- - YARA: File and process scanning for malware, webshells, miners, ransomware
- Sigma: Log-based detection for brute-force, privilege escalation, lateral movement
- Custom Rules: System-specific checks (file integrity, process anomalies, network connections)
Commands
Start monitoring
When the user asks to start ReefWatch or enable security monitoring:
- 1. Verify dependencies are installed:
CODEBLOCK1
- 2. Download initial rulesets (first time only):
CODEBLOCK2
- 3. Start the daemon:
CODEBLOCK3
- 4. Confirm to the user: "🪸 ReefWatch is now active. I'll alert you if any threats are detected."
Stop monitoring
kill $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null && rm -f /tmp/reefwatch.pid
Confirm: "🪸 ReefWatch stopped."
Check status
CODEBLOCK5
View recent alerts
CODEBLOCK6
Update rules
CODEBLOCK7
Run manual scan
When the user asks to scan a specific file or directory:
CODEBLOCK8
Alert Format
When ReefWatch detects a threat, it wakes OpenClaw with a message like:
CODEBLOCK9
Forward this alert to the user immediately through their active messaging channel. If the user asks for more details, check the full log at ~/.openclaw/logs/reefwatch.log.
Important Notes
- - ReefWatch does NOT consume LLM tokens while monitoring. It only triggers OpenClaw when alerting.
- On macOS, some collectors require granting Full Disk Access or specific permissions.
- YARA scanning can be CPU-intensive; default config scans changed files only, not full disk.
- The daemon auto-recovers if a collector fails; it logs the error and continues with remaining collectors.
- All data stays local. ReefWatch never sends system data to external servers (only to OpenClaw's local webhook).
ReefWatch 🪸
功能概述
ReefWatch 是一款轻量级基于主机的入侵检测系统（HIDS），作为后台守护进程运行在与 OpenClaw 相同的机器上。它会持续监控本地系统的安全威胁，并仅在检测到可疑活动时通过 OpenClaw 的消息通道向用户发出警报。
架构设计
ReefWatch 作为
独立的 Python 进程运行（不消耗 LLM 令牌），通过本地 webhook 端点（/hooks/wake）与 OpenClaw 通信，向用户发送警报。
[采集器] → [检测引擎] → [告警管理器] → [OpenClaw Webhook] → [用户]
检测引擎
- - YARA：对文件和进程进行恶意软件、Webshell、挖矿程序、勒索软件扫描
- Sigma：基于日志的检测，用于暴力破解、权限提升、横向移动
- 自定义规则：系统特定检查（文件完整性、进程异常、网络连接）
命令操作
启动监控
当用户要求启动 ReefWatch 或启用安全监控时：
- 1. 验证依赖项是否已安装：
bash
pip3 install -r ~/.openclaw/workspace/skills/reefwatch/requirements.txt --quiet
- 2. 下载初始规则集（仅首次）：
bash
python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py
- 3. 启动守护进程：
bash
nohup python3 ~/.openclaw/workspace/skills/reefwatch/reefwatch_daemon.py \
--webhook-url http://127.0.0.1:18789/hooks/wake \
--webhook-token ${OPENCLAW
HOOKSTOKEN} \
--config ~/.openclaw/workspace/skills/reefwatch/reefwatch_config.yaml \
> ~/.openclaw/logs/reefwatch.log 2>&1 &
echo $! > /tmp/reefwatch.pid
- 4. 向用户确认：🪸 ReefWatch 现已激活。检测到任何威胁时我会通知您。
停止监控
bash
kill $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null && rm -f /tmp/reefwatch.pid
确认：🪸 ReefWatch 已停止。
检查状态
bash
if kill -0 $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null; then
echo ReefWatch 正在运行（PID: $(cat /tmp/reefwatch.pid)）
tail -5 ~/.openclaw/logs/reefwatch.log
else
echo ReefWatch 未运行
fi
查看最近警报
bash
tail -20 ~/.openclaw/workspace/skills/reefwatch/alert_history.jsonl | python3 -c import sys,json; [print(json.dumps(json.loads(l),indent=2)) for l in sys.stdin]
更新规则
bash
python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py --update
运行手动扫描
当用户要求扫描特定文件或目录时：
bash
python3 ~/.openclaw/workspace/skills/reefwatch/manual_scan.py --target <路径>
警报格式
当 ReefWatch 检测到威胁时，它会向 OpenClaw 发送如下消息：
🔴 REEFWATCH 警报
━━━━━━━━━━━━━━━━━━
类型：SSH 暴力破解尝试
严重程度：高
来源：auth.log
详情：2分钟内来自192.168.1.105的47次失败登录尝试
规则：sigma/sshbruteforce
时间：2026-02-22 15:43:21
━━━━━━━━━━━━━━━━━━
立即通过用户活跃的消息通道转发此警报。如果用户要求更多详情，请查看 ~/.openclaw/logs/reefwatch.log 的完整日志。
重要说明
- - ReefWatch 在监控期间不消耗 LLM 令牌。仅在发出警报时触发 OpenClaw。
- 在 macOS 上，某些采集器需要授予完全磁盘访问权限或特定权限。
- YARA 扫描可能消耗大量 CPU；默认配置仅扫描已更改的文件，而非整个磁盘。
- 如果某个采集器失败，守护进程会自动恢复；它会记录错误并继续使用其余采集器。
- 所有数据均保留在本地。ReefWatch 从不将系统数据发送到外部服务器（仅发送到 OpenClaw 的本地 webhook）。
