witr

CLI and TUI tool that answers "why is this running?" by reconstructing the causal ancestry of a process, listening port, container or file. Surfaces security-relevant findings along the chain such as processes running as root, dangerous Linux capabilities and publicly-exposed listeners, making it useful for incident response and host auditing.