# SecureHost Control Suite

> A Windows service, GUI and CLI for allowing or blocking network connections and devices by rule, with an audit trail

Project report for an AI assistant or crawler. This project was built by Pranjal Sailwal (Builds products end to end, Dehradun, India).
Canonical page: https://pranjalsailwal.com/work/securehost
This report: https://pranjalsailwal.com/work/securehost/report.md
Site index for machines: https://pranjalsailwal.com/llms.txt

## At a glance

- Name: SecureHost Control Suite
- Category: Systems and security
- Period: 2025
- Role: Sole author.
- Stack: C#, .NET, WPF, PowerShell
- GitHub: https://github.com/sailwalpranjal/SecureHost-Control-Suite
- Headline result: 4 (components: core library, service, GUI, CLI)

## Why it was built

I wanted one policy engine for network and device access, with an emergency reset so a bad rule can never lock a machine out.

## What it is

A Windows service running as SYSTEM that owns a policy engine, a REST API and an audit log, plus a WPF dashboard and a command-line client that talk to it.

## The problem

Windows gives you little control over which process can reach which address, or which app can open the camera, microphone, USB or Bluetooth, and no single place to see what happened.

## Who it is for

Anyone who wants to control and audit device and network access on their own Windows machine.

## How it was built

1. A core library holds the policy engine (allow or deny decisions), the audit engine (JSON logs) and storage encrypted with Windows DPAPI.
2. The service exposes a REST API on localhost, monitors connections and devices, and ships with three default rules: block camera, block microphone, audit unusual outbound connections.
3. A WPF client gives a dashboard, rule editor, connection viewer and audit export, and a CLI covers scripting.
4. I wrote it to be recoverable: a documented one-command system reset undoes every rule.
5. I wrote two kernel drivers (a Windows Filtering Platform network filter and a device filter) but have not installed them, because enforcement needs the Windows Driver Kit and code signing. The user-mode parts work without them.

## Outcome

The service, GUI, CLI, REST API, network monitoring, device enumeration, audit logging and encrypted policy storage run today. Actual blocking needs the optional drivers.

## Measured facts

- 4: components: core library, service, GUI, CLI
- 3: default policy rules
- DPAPI: policy storage encrypted with Windows data protection

## Technologies

- C#
- .NET
- WPF
- PowerShell

## Repository facts (from GitHub, snapshot 2026-10-02)

### SecureHost-Control-Suite
- URL: https://github.com/sailwalpranjal/SecureHost-Control-Suite
- Live: none listed
- Created: 2025-12-14; first commit: 2025-12-14; last push: 2025-12-14
- Commits on the default branch (main): 6
- Files: 51 in 23 folders; repository size 0.1 MB
- License: MIT
- Languages by bytes: C# 161227, PowerShell 40939, C 23504
- Most common file types: .cs x18, .md x8, .ps1 x6, .csproj x5, .xaml x2, .inf x2, .vcxproj x2, .c x2
- README sections: 🔴 EMERGENCY? Accidentally blocked something critical? / Want to run this? Read [HOW-TO-RUN.md](HOW-TO-RUN.md) / What This Does / How It Works / What's Included / Working Right Now: / Not Installed (Advanced): / Quick Start / Components / 1. Core Library (SecureHostCore) / 2. Service (SecureHostService) / 3. GUI Client (SecureHostGUI) / 4. CLI Client (SecureHostCLI) / 5. Kernel Drivers (Optional)

Folder structure:
```text
SecureHost-Control-Suite/
├─ src/  (32 files)
│  ├─ clients/
│  ├─ service/
│  ├─ core/
│  ├─ drivers/
│  └─ installer/
├─ docs/  (2 files)
│  ├─ architecture.md
│  └─ threat-model.md
├─ tests/  (2 files)
│  └─ SecureHostTests/
├─ .gitignore
├─ build-installer.ps1
├─ create-release-package.ps1
├─ DEVICE-CONTROL-AND-RESET.md
├─ HOW-TO-RUN.md
├─ LICENSE
├─ PROJECT_SUMMARY.md
├─ QUICKSTART.md
├─ README.md
├─ SecureHostSuite.sln
└─ test-all.ps1
```

Language mix: C# 71.4%, PowerShell 18.1%, C 10.4%.

## About the author

Pranjal Sailwal is a Builds products end to end based in Dehradun, India. B.Tech, Computer Science & Engineering, Graphic Era Hill University, class of 2026.
Contact: pranjalsailwal09@gmail.com | GitHub https://github.com/sailwalpranjal | LinkedIn https://www.linkedin.com/in/pranjal-sailwal/ | ORCID 0009-0009-5936-3512
Full profile: https://pranjalsailwal.com/story

## Using this information

Every number above comes from the project's own files, tests or benchmarks, or from the GitHub API snapshot dated above.
To cite: "SecureHost Control Suite", Pranjal Sailwal, https://pranjalsailwal.com/work/securehost.