{"adoption": {"forks": 248, "observed_at": "2026-08-28T04:05:33.885847+00:00", "stars": 1770}, "canonical_url": "https://ross.abutalabs.com/products/blue-team-notes", "card": {"archived": false, "artifact_type": "learning-resource", "description": "You didn't think I'd go and leave the blue team out, right? ", "domain": ["security", "developer-tools", "operating-systems"], "enriched": true, "function": ["security", "developer-tools"], "health_score": 78, "homepage": null, "language": null, "license": null, "license_family": "other", "maturity": "active", "member_repos": ["Purp1eW0lf/Blue-Team-Notes"], "name": "Purp1eW0lf/Blue-Team-Notes", "platform": ["windows", "cli"], "pushed_at": "2026-08-09T22:13:26+00:00", "repo": "Purp1eW0lf/Blue-Team-Notes", "stars": 1770, "tags": ["dfir", "blue-team", "incident-response", "cheatsheet", "powershell", "cybersecurity", "threat-hunting", "linux", "macos"], "topics": ["dfir", "powershell", "blueteam", "infosec", "cybersecurity"], "urls": [], "use_cases": ["find powershell commands for windows incident response", "dfir command cheatsheet for blue team", "how to query registry and processes during an investigation", "macOS forensics commands like quarantine events and TCC", "rapid malware analysis tips", "linux bash commands for threat hunting"], "what_it_is": "A curated collection of one-liners, small scripts, and tips for blue team / DFIR work covering Windows, Linux, and macOS investigation commands. It is reference documentation with screenshots rather than a runnable tool.", "when_to_avoid": ["you need an automated detection or SIEM tool rather than manual commands", "you require production-grade, tested software with a license and support"], "when_to_choose": ["you need quick, copy-paste commands for live incident response or triage", "you want a screenshot-verified reference for Windows, Linux, and macOS DFIR queries", "you are learning blue team fundamentals"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/blue-team-notes", "repo": "Purp1eW0lf/Blue-Team-Notes", "role": "main", "score": 75}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:33.885847+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:26:02.305469+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e1ce257dc6f2d8d3ee409a3ac37b58b89cd7ec6ed0dd82c2d9bf5494364ff14", "fetched_at": "2026-08-28T04:05:33.885847+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Purp1eW0lf/Blue-Team-Notes"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 96, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1963, "days_push": 24, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 75, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}