MACOS SECURITY · BUILT FOR THE CURIOUS

Is anything
odd?

A Mac looked normal yesterday. What changed today? Oddity checks persistence, privilege, network exposure, startup history, and FileMaker authentication activity — then shows its work.

↓ Download the Latest Oddity Explore every check →

Free for macOS · Updated frequently · Current release details below

Read-only scanningLocal + agentless SSHBaseline comparisonsEvidence-first findings

● ● ●ODDITY / SECURITY FINDINGS● SCAN COMPLETE

TARGET FILEMAKER SERVER · SSH

WARNINGRepeated FileMaker authentication failures

63 failed entries · 9 account labels
2 databases · 24-hour sample

NOTICENew listening endpoints since baseline

Process / protocol / port evidence

INFOLegacy macOS posture acknowledged

Accepted in approved baseline

OBSERVE → COMPARE → EXPLAIN STAY ODD_

Illustrative, anonymized presentation based on a real scan; not a live security dashboard.

ACTUAL APPLICATION · OCTOBER 2026

Real scans.
Real evidence.

Explore Oddity's actual interface, from FileMaker authentication findings to live network activity. Server addresses and example log details have been replaced with demonstration values.

Oddity's FileMaker authentication findings view showing security alerts and supporting evidence — **FileMaker Security**Authentication findings with severity, context and log evidence.

Oddity live network graphical visualization — **Network Live · Graph**Visualize current connections and inspect network activity.

Oddity overview dashboard showing a server requiring attention — **At-a-glance overview**See scan state, baseline protection and restart information.

Click a screenshot to inspect it here without leaving the page. Screenshots use demonstration server addresses and sample log details; no blur effects.

01See the facts

02Compare to your baseline

03Investigate the evidence

00Required remote agents

THE FULL TOOLBOX

Made for people who
read the logs.

Not a mysterious “security score.” A growing collection of concrete checks, each with context and evidence. Filter by area to explore what's available.

01 / INTEGRITY

SHA-256 baselines

Explicitly approve a known state, then inspect subsequent changes. Clear and reassess without silently replacing your baseline.

BASELINE CONTROL

02 / PERSISTENCE

Launch agents & daemons

Inspect macOS persistence surfaces and identify newly observed or changed startup mechanisms.

CHANGE DETECTION

03 / PRIVILEGE

Administrative access

Track security-relevant account and privilege changes, SSH keys, and configuration signals.

SECURITY POSTURE

04 / NETWORK

Who's listening?

Review processes, protocols and listening endpoints. Suppress known processes that only change ephemeral ports.

LISTENER DIFFS

05 / FIREWALL

Firewall & exposure

Record firewall posture and detect meaningful changes in externally visible or locally listening services.

CONFIGURATION EVIDENCE

06 / SSH

SSH hardening signals

Surface password authentication and other SSH configuration details without assuming every deviation is malicious.

CONTEXT MATTERS

07 / FILEMAKER

Authentication failures

Read sampled FileMaker Event.log and Access.log entries, aggregate repeated failures by source IP, and report targeted account labels and databases.

BUILD 35

08 / FILEMAKER

Success after failure

Review potentially important successful authentications following failures when supported by collected log evidence.

EVIDENCE-BASED

09 / REMOTE

Agentless SSH scanning

Inspect remote Macs without installing an Oddity agent on every server. Older macOS targets can be monitored from a supported host.

REMOTE COLLECTION

10 / RESTARTS

Restart intelligence

Compare boot and shutdown history, distinguish recorded shutdowns from proven initiators, and report uncertainty honestly.

CONFIDENCE-AWARE

11 / HISTORY

Historical comparisons

Preserve scan history and compare the current state with previous observations and approved baselines.

NO SILENT REBASELINING

12 / REPORTS

Exportable findings

Review severity, summaries, and supporting evidence, then share findings through generated reports.

PDF REPORTING

YOUR SERVERS, ONE VIEW

See what changed.
Then drill down.

Scan status, historical context and actionable findings—right where administrators need them.

Oddity scan overview, demonstration server — Overview · Scan posture and baseline state

BUILT WITH FILEMAKER ADMINS IN MIND

Who tried
to get in?

FileMaker Server logs tell a story. Oddity helps you read it without mistaking every typo for an intrusion.

Examine a sample finding ↗

FILEMAKER SECURITY / CURRENT COVERAGE v0.32

Event.log and Access.log authentication entries
Failure aggregation by source IP
Distinct account labels and affected databases
Success-after-failure review
Missing / inaccessible log coverage warnings
Local and SSH-collected server logs

Know the limits. The current collector examines a bounded recent sample (up to 50,000 tailed lines and 2,000 matching entries per file), not every historical event. Rotated logs and cross-server correlation are not yet included. Client-specific parsing should be validated against real logs.

ACTUAL FILEMAKER LOG ANALYSIS

Warnings with
receipts.

Investigate repeated authentication failures, affected databases and the evidence behind a finding.

Oddity FileMaker authentication findings — FileMaker · Authentication evidence

TRANSPARENT BY DESIGN

Don't cry wolf.
Show the evidence.

A failed login is a fact. A compromise is a conclusion that requires more evidence. Oddity keeps those ideas separate.

WARNING

Repeated FileMaker authentication failures

Illustrative anonymized excerpt from an actual FileMaker Server finding

63failed entries

9account labels

2databases

24hsample window

Expand the evidence and interpretation +

Source IP: 203.0.113.42 (anonymized example)
Interface: WebDirect (observed in sample)
Databases: Database_A.fmp12, Database_B.fmp12
Assessment: repeated failures; intent not established

Multiple users may share an office IP. A burst of failures may be suspicious, but volume alone does not prove password spraying or unauthorized access. This example is intentionally anonymized.

NETWORK VISIBILITY

Connections aren't
invisible anymore.

Explore network activity as a graphical view or a detailed connection list.

Oddity network connection graph — Live Network · Graph

Oddity network connections table, cropped to avoid identifying information — Live Network · Connection details

UNDER THE HOOD

No magic. Just careful inspection.

Read-only first

Oddity gathers security-relevant observations rather than automatically modifying a monitored server.

Approved baselines

Changes are compared against the state you explicitly accepted. Expected exceptions can be acknowledged without hiding history.

Remote by SSH

Mac / SSH scans use the existing remote-access path; target-side permissions determine which evidence is available.

Evidence & uncertainty

Findings describe what was observed and acknowledge missing logs, ambiguous initiators, or inconclusive activity.

Technical notes

The Oddity application requires macOS 14 or later to run. Remote SSH targets may run older macOS versions, with collection capabilities varying by OS version and permissions. FileMaker log monitoring was introduced in Build 35 and requires FileMaker Server logs to be accessible.

Privacy & trust

Security scans can contain hostnames, IP addresses and account labels. Treat exported reports accordingly. Optional feedback and future update-check features may contact external services; we will document exact data flows as they ship. Check the downloaded app's signing and notarization status independently.

SCAN HISTORY

Yesterday matters.
So does today.

Compare observations over time without silently rewriting an approved baseline.

Oddity scan history, cropped to remove server identities — History · Previous scans and baseline actions

FREQUENTLY IMPROVED

What's new
in Oddity?

One release manifest powers this page and is designed to support an optional in-app update notifier in a future Oddity build.

LATEST LISTED RELEASE

v0.32 Build 35

October 28, 2026

FileMaker authentication log monitoring
Remote timezone interpretation improvements

↓ Download the Latest Oddity

Check the published download before announcing a new version.

Recent development

Build 35 · FileMaker log analysis

Build 34 · Legacy restart-history parsing

Build 33 · Restart confidence improvements

Release metadata loads from version.json. Dates and build availability should be verified before publication.

READY TO LOOK CLOSER?

Your Mac has a story.
Find the odd bits.

Free for macOS. Updated frequently. Come back to see what changed.