# airbnb/binaryalert

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

Repository: https://github.com/airbnb/binaryalert
Canonical: https://ross.abutalabs.com/products/binaryalert
Homepage: https://binaryalert.io
Language: Python
License: Apache-2.0
License Family: permissive
Topics: security, yara, serverless, terraform, lambda, aws, malware-detection
Last push: 2023-12-12T18:28:30+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3339, "days_push": 995, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1455, forks 180 (observed 2026-08-28T04:04:46.869228+00:00)

## What it is
BinaryAlert is an open-source serverless AWS pipeline that scans every file uploaded to an S3 bucket against a configurable set of YARA rules and fires alerts on matches. It is deployed entirely via Terraform, uses Lambda for all computation, and supports retroactive rescanning of the file corpus when rules change.

## Use cases
- detect malware in files uploaded to S3 in real time
- scan an existing file corpus with new YARA rules retroactively
- set up serverless malware detection in my AWS account
- alert my incident response team when a malicious binary is found
- manage YARA rules across a team and deploy them to a scanning pipeline
- analyze millions of files per day without managing servers

## When to choose
- you are AWS-centric and want a serverless, Terraform-deployed malware scanner
- you need real-time YARA-based file scanning with SNS alerting
- you want retroactive analysis when your ruleset changes
- you prefer no servers to maintain and pay-per-use costs

## When to avoid
- you need on-premises or non-AWS deployment
- you need deep static/dynamic analysis beyond YARA matching (e.g., sandboxing, reverse engineering)
- you require real-time sub-second detection outside an S3-upload workflow
- you need actively developed features - the project is in maintenance mode

## Facets
- artifact type: service
- maturity: maintenance
- function: security, monitoring, alerting, infrastructure-as-code, serverless
- domain: security, cloud-computing
- platform: cloud, python, serverless
- tags: yara, malware-detection, aws-lambda, s3, incident-response, retroactive-scanning, devops, terraform

## Member repositories
- airbnb/binaryalert (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:46.869228+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:38.354917+00:00, confidence not recorded.
  - readme: https://github.com/airbnb/binaryalert (fetched 2026-08-28T04:04:46.869228+00:00, sha 863b973c7977)
  - homepage: https://binaryalert.io (fetched 2026-08-29T11:45:47.397209+00:00, sha e5a874e3efa4)
- Data as of 2026-08-30T08:39:29.467469+00:00.