Demo of yoman, the audit-trail dashboard from this case study. Synthetic data, regenerated on every restart.

yoman

task_log · demo house
DEFCON 2backup · backup-watch · no snapshot for 36 h2026-10-16 04:40:32
deviceaddressinout totallast seen
workstation10.20.0.11184 GiB31.4 GiB215 GiB2026-10-16 07:25:32
tv10.20.0.4194.4 GiB20.5 GiB115 GiB2026-10-16 07:28:32
laptop-110.20.0.2142.9 GiB10.2 GiB53.2 GiB2026-10-16 07:15:32
laptop-210.20.0.2240.0 GiB5.3 GiB45.3 GiB2026-10-16 07:21:32
server-110.20.0.239.0 GiB3.0 GiB42.1 GiB2026-10-16 07:24:32
phone-110.20.0.3132.0 GiB2.5 GiB34.5 GiB2026-10-16 07:13:32
phone-210.20.0.3215.1 GiB2.1 GiB17.3 GiB2026-10-16 07:11:32
10.20.0.12.3 GiB272 MiB2.5 GiB2026-10-16 07:11:32
sensor-310.20.0.53163 MiB15.7 MiB178 MiB2026-10-16 07:35:32
sensor-210.20.0.52149 MiB28.5 MiB177 MiB2026-10-16 07:20:32
sensor-110.20.0.51139 MiB10.8 MiB150 MiB2026-10-16 07:14:32

In the real house this is built from the router's flow records, joined to its DHCP leases. An address with no lease still counts, and shows as the address.