Windows GUI tools for baseline-driven endpoint process and network monitoring that capture a snapshot of running processes and connections, then continuously track post-baseline changes without discarding history. They correlate data in a unified view, with an extended version integrating optional Sysmon telemetry for deeper timeline visibility.