OSWatcher Plugins

August 23, 2026 · View on GitHub

Analysis plugins for OSWatcher — extract and analyze operating system artifacts (filesystem, registry, PDB symbols, syscalls) and store them as a queryable graph in Neo4j.

Installation

pip install oswatcher-plugins

Plugins

Plugin	Description
`FileTypePlugin`	Identifies file types within OS filesystem snapshots
`SymbolsPlugin`	Extracts PDB symbols and struct layouts from PE binaries
`WinRegistryPlugin`	Parses and inserts Windows registry hives
`SyscallsPlugin`	Extracts Windows/Linux syscall tables
`LinuxSymbolsPlugin`	Extracts Linux kernel debug symbols

Usage

Plugins are run via the runner CLI against a single neogit commit:

runner <commit_hash> <plugin_name>
# example:
runner 930b7dc140b50b00c192a9ae7f97174823deb378 SYMBOLS

Available plugins: FILETYPE, SYMBOLS, WINREG, SYSCALLS, LINUX_SYMBOLS (the name is case-insensitive). Use runner --help for the full option list, including --force to rerun a plugin that has already been executed on the commit.

Requirements

Python 3.11+
A running Neo4j instance (configured via neogit settings)
neogit — the underlying graph storage library

Documentation

License

Apache 2.0 — see LICENSE.