- witr is a tool designed to answer the question 'Why is this running?' by explaining the causality behind processes, services, or ports.
- It provides a human-readable output showing how a process was started, its ancestry chain, and the primary system responsible for it.
- witr supports multiple entry points like process names, PIDs, or ports, and converges to PID analysis.
- Key features include zero configuration, read-only operation, clarity over completeness, and not being a monitoring or remediation tool.
- It can explain processes, services, containers, and commands by mapping them to PIDs and building a causal chain.
- witr offers various flags for customization, such as --short for one-line summaries, --tree for full ancestry trees, and --json for JSON output.
- Installation is simple via a script or manual steps, supporting both amd64 and arm64 architectures.
- witr requires Linux and may need elevated permissions (sudo) for detailed process information.
- Success for witr is measured by quick understanding, reduced tool reliance, and trust during incidents.
- The project was developed with AI/LLM assistance under human supervision.