---
description: Run a network transfer audit for a time window and generate an interactive HTML report
---

# Network Transfer Audit Workflow

The primary interface for running audits is the **Sensor Audit Dashboard**.

## Steps

1. **Ensure the dashboard is running**
```bash
/Users/sd9235/code/mygh/learning_ai_mac_tooling/audit-ctl.sh start
```

2. **Open the dashboard**
```bash
/Users/sd9235/code/mygh/learning_ai_mac_tooling/audit-ctl.sh open
```
Navigate to **Run Audit** in the sidebar.

3. **Choose a mode in the dashboard UI**:
   - **One-shot Audit** — Analyze past network activity for a time window
   - **Monitor** — Actively monitor transfers for a duration, then report
   - **Continuous Collection** — Long-running data collection into SQLite

4. **Click Start Audit** — Output streams in real-time. When done, click **Open Report** to view the HTML report.

5. **View reports** — Go to the **Reports** page in the sidebar to see all generated HTML reports.

6. **Browse sessions** — Go to **Sessions** to explore collected data and sensor samples. Click **Generate Report** on any session to create an HTML report from it.

## CLI Fallback

For headless or SSH scenarios, the CLI still works:

```
python3 tools/network_transfer_audit.py [TIME] [OPTIONS]

Time (pick one, required):
  --last DURATION          Relative: 30m, 2h, 1d, 7d
  --from DATETIME          Absolute start: "YYYY-MM-DD" or "YYYY-MM-DD HH:MM"

Options:
  --to DATETIME            End time (default: now)
  --live                   Include live connection snapshot
  --monitor DURATION       Monitor transfers for DURATION (5m, 10m, 1h) before report
  --json                   Output as JSON
  --html FILE              Generate interactive HTML report

Continuous Collection:
  --collect DURATION       Collect data for DURATION (e.g. 12h, 1d) into SQLite
  --interval SECONDS       Collection interval (default: 300 = 5 min)

Query Collected Data:
  --data SESSION_ID        Query collected data from a session
  --sessions               List all collected sessions
```

## Management Script

```bash
./audit-ctl.sh start          # Start dashboard (API + UI on port 8742)
./audit-ctl.sh stop           # Stop dashboard
./audit-ctl.sh status         # Check health + stats
./audit-ctl.sh collect 12h    # CLI collection shortcut
./audit-ctl.sh install        # Auto-start on login via launchd
./audit-ctl.sh open           # Open dashboard in browser
```
