# yampelo/beagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Repository: https://github.com/yampelo/beagle
Canonical: https://ross.abutalabs.com/products/beagle
Language: Python
License: MIT
License Family: permissive
Topics: security, digital-forensics, incident-response, graph, dfir, forensic-analysis, threat-hunting
Last push: 2022-12-13T21:24:54+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3146, "days_push": 1359, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1351, forks 151 (observed 2026-08-28T04:04:28.324798+00:00)

## What it is
Beagle is an incident response and digital forensics tool that transforms security logs and data sources such as EVTX files, SysMon logs, FireEye HX triages, PCAPs, and memory images into graphs. It can be used as a Python library or through a web interface, and outputs graphs to Neo4j, DGraph, or local NetworkX objects.

## Use cases
- transform evtx and sysmon logs into investigation graphs
- analyze fireeye hx triage data as a graph
- load windows memory images for forensic analysis
- send forensic graphs to neo4j or dgraph for threat hunting
- explore incident response artifacts interactively in a web ui
- combine multiple forensic data sources into one graph

## When to choose
- you need to turn DFIR artifacts like EVTX, SysMon, or memory dumps into navigable graphs
- you want a Python library plus web UI for forensic graph generation
- you want to push investigation graphs into Neo4j or DGraph

## When to avoid
- you need a full SIEM or log aggregation platform
- your data sources are unsupported by Beagle's datasource list
- you need actively developed tooling with frequent releases

## Facets
- artifact type: application
- maturity: maintenance
- function: security, parser, data-visualization
- domain: security, developer-tools, analytics
- platform: python, cross-platform
- tags: dfir, incident-response, digital-forensics, threat-hunting, graph-database, networkx, neo4j, evtx, sysmon, graph, docker, web-server

## Member repositories
- yampelo/beagle (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:28.324798+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:42:14.657478+00:00, confidence not recorded.
  - readme: https://github.com/yampelo/beagle (fetched 2026-08-28T04:04:28.324798+00:00, sha 682898b5f9eb)
- Data as of 2026-08-30T08:39:29.467469+00:00.