Kharma Evolution is an elite, proactive network defense suite designed to eliminate "blind spots" in system visibility. Unlike traditional monitors, it acts as an Active Defense System by mapping outbound connections to their exact process IDs and executables in real-time. It features a built-in Malware Threat Intelligence engine (Firehol integration), Deep Packet Inspection (DPI) for payload signature matching, and a stunning glassmorphism Web Dashboard. It also includes an offline MaxMind GeoLite2 engine for 0ms lag geolocation and a high-performance SQLite background logger for forensic audits.

Dependencies: python3, python3-click, python3-rich, python3-psutil, python3-requests, python3-maxminddb, python3-vt-py, python3-flask, python3-scapy

Similar tools: netstat, lsof, tcpdump (but Kharma aggregates geolocation, cloud threat intel, and process-level DPI into one seamless, high-performance TUI and Web Dashboard).

Activity: Actively developed and maintained. Current focus: Proactive defense, automated malware termination, and federated swarm oversight.

How to install: pip install kharma-radar (or use the provided .deb package in the releases).

How to use: kharma run — Start the Live Terminal Radar. kharma run --protect — Start Radar with Automated Malware Killing (Active Defense). kharma web — Launch the Interactive Web Dashboard on localhost. kharma daemon start — Deploy the silent background monitor with Telegram alerts. kharma history — View the Time Machine forensic connection log.

Note on Packaging: Debian and Kali-specific packaging metadata (control, rules, changelog) are fully prepared and available in the linux_pkg/debian/ directory of the upstream repository.