# Monitored runs
Source: https://docs.privacycommand.privacykey.org/monitored-runs

Launch the inspected app under observation and watch what it actually touches.

Static analysis shows capability. A monitored run shows behaviour.

privacycommand launches the inspected app and streams what it does in real time:

| Stream | What you see |
|---|---|
| **File events** | Reads and writes, via `fs_usage` through the [helper](https://docs.privacycommand.privacykey.org/privileged-helper) |
| **Network** | Destinations with reverse-DNS labels, click-through IP lookups, row highlighting, and a highlighted-only filter |
| **Processes** | Child processes the app spawns |
| **Device access** | Pasteboard, camera, microphone, and screen-recording activity |
| **USB** | Device interactions |
| **Resources** | CPU, memory, and disk over the life of the run |

A heat-graded callout fires when something spikes — a burst of disk writes, a
fresh outbound host, a CPU climb that wasn't there a moment ago.

## What you need

File-event monitoring requires the [privileged helper](https://docs.privacycommand.privacykey.org/privileged-helper),
because `fs_usage` needs root. The other streams do not.

> **Warning**
>
> **A monitored run executes the app.** If you have real doubts about a bundle,
> do this inside [VM mode](https://docs.privacycommand.privacykey.org/vm-mode) instead, where the blast radius is a
> disposable guest rather than your Mac.

## Getting useful coverage

Dynamic analysis only sees the code paths you exercise. An app sitting on its
launch screen will barely touch anything.

- **Drive the features you care about.** If you want to know whether the export
  function uploads anything, run an export.
- **Watch the first thirty seconds.** Analytics and attribution SDKs typically
  fire their first beacon at startup.
- **Let it idle afterwards.** Some telemetry batches on a timer and won't appear
  until minutes in.
- **Then check what changed at rest.** Some apps only phone home on quit.

## Watch mode

Some behaviour won't show up in the ten minutes you're prepared to sit there:
licence-server pings, telemetry that batches on a timer, a scheduled update
check, a phone-home the day a trial expires. Watch mode is a monitored run you
leave running.

Start it from **Run → Start Watching…** (⇧⌘W) or the eye button in the header —
either one starts a run first if there isn't one already. Then:

- **A menu-bar icon appears** with an unread badge. A change detector diffs each
  tick of the run against the previous one and posts a single entry per
  genuinely new thing: a destination not contacted before, a new behavioural
  anomaly, an event the risk classifier called surprising, a live-probe event, a
  CPU spike. Clicking the icon opens the list and marks it read.
- **Closing the main window does not quit privacycommand.** This is the part
  worth knowing in advance — while watching, the app deliberately stays alive
  with the menu-bar icon as your only handle on it. **Stop Watching** — ⇧⌘W
  again, or the header button — ends the watch and the run together.
- The icon style is yours to pick under **Settings → General**.

Everything else is an ordinary monitored run, with the same requirements — file
events still need the helper.

## Pausing the target

You can freeze the inspected app and its child processes mid-run, then resume
them. That's ordinary process suspension — useful for reading a fast-scrolling
event list without losing the run.

It stops the app from doing anything further, but it does **not** sever
connections already open. For that, see the
[network kill switch](https://docs.privacycommand.privacykey.org/kill-switch).

## Reading the network tab

Destinations are reverse-DNS labelled, so `142.250.80.14` shows up as something
recognisable rather than a bare address. Rows can be highlighted and then
filtered to highlighted-only, which is the practical way to work through a busy
run: mark the interesting destinations as you go, then review just those.

Bear in mind that a reverse lookup shows the *hosting* party. A connection to a
cloud provider's address tells you the provider, not necessarily who rented it.