Getting Started

Getting Started

Wizard mode (novice)

Triggered by double-clicking the compiled executable, or by launching the script without arguments:

python3 process_analyzer_allinone.py

It asks at most two to four questions:

1. Maximum number of processes to include in the graph (default 150 — the most active in CPU+RAM take priority; exclusions are always logged, never silent).
2. Ollama model for enrichment:
   • installed models are listed by number (0 disables AI);
   • if Ollama is missing, the wizard offers to install it (explicit consent required);
   • if Ollama runs but has no model, the wizard offers to download the default one;
   • declining never blocks the analysis — it just continues without AI.

The number of AI-enriched processes is derived automatically (min(max_processes, 40)).

At the end of the run, only the 3D HTML graph is written (outputs/process_graph_3d_YYYYMMDD_HHMMSS.html) and opens automatically in the default browser. The console window waits for a key press before closing.

Command-line mode

Used as soon as at least one argument is passed:

python3 process_analyzer_allinone.py --help

Common examples:

# Fast run without AI, top 50 processes
python3 process_analyzer_allinone.py --no-enrich --max-processes 50

# Full run with JSON + CSV + Markdown report
python3 process_analyzer_allinone.py --json-export data.json --csv-export data.csv --report report.md

# Continuous monitoring every 30 s
python3 process_analyzer_allinone.py --watch --interval 30

See CLI Reference for every flag and Advanced Modes for watch/forensics/baseline/cache workflows.

Output files

File	Default?	Content
process_graph_3d_*.html	Yes (unless --no-html)	Interactive graph — opens in any browser. Needs internet at opening time (CDN library).
process_graph_*.png	--png	Static render with legend.
process_data_*.json	--json-export	Raw export of all collected data, risk and enrichment.
*.csv	--csv-export	One line per process, flattened fields.
report_*.md	--report	Executive summary (risk distribution, top consumers, high-risk processes…).

Run artifacts (history, baseline, integrity database, enrichment cache) live in outputs/ by default.