{"adoption": {"forks": 303, "observed_at": "2026-08-28T04:08:12.964214+00:00", "stars": 3648}, "canonical_url": "https://ross.abutalabs.com/products/chainsaw", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Rapidly Search and Hunt through Windows Forensic Artefacts", "domain": ["security", "developer-tools"], "enriched": true, "function": ["search-engine", "security", "parser", "cli"], "health_score": 100, "homepage": null, "language": "Rust", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "active", "member_repos": ["WithSecureLabs/chainsaw"], "name": "WithSecureLabs/chainsaw", "platform": ["windows", "cli", "rust"], "pushed_at": "2026-08-25T19:12:42+00:00", "repo": "WithSecureLabs/chainsaw", "stars": 3648, "tags": ["dfir", "threat-hunting", "forensics", "sigma-rules", "event-logs", "incident-response", "blueteam", "mft", "shimcache", "srum", "command-line", "linux", "macos"], "topics": ["attack", "rust", "security", "threat-hunting", "blueteam", "chainsaw", "detection", "dfir", "forensics", "logs", "sigma", "windows", "countercept"], "urls": [], "use_cases": ["hunt for threats in Windows event logs using Sigma rules", "search forensic artefacts for keywords and regex patterns", "build execution timelines from Shimcache and Amcache", "analyse SRUM database usage data", "dump raw content of MFT and registry hives", "first-response triage during incident response"], "what_it_is": "Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registry hives. It supports Sigma detection rules and custom detection logic to identify threats during incident response.", "when_to_avoid": ["you need continuous real-time endpoint monitoring or EDR capabilities", "you require centralized log aggregation across a fleet of machines", "you need non-Windows forensic artefact support"], "when_to_choose": ["you need fast offline analysis of Windows event logs and forensic artefacts", "you want Sigma rule support in a lightweight CLI without a SIEM", "you're doing DFIR first-response on an endpoint without EDR coverage"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/chainsaw", "repo": "WithSecureLabs/chainsaw", "role": "main", "score": 99}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:08:12.964214+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T18:31:42.459874+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ada8e755887dba1ed8fdb28645a0b18267f64c71212bf2bd9b8dcf87e2cf823f", "fetched_at": "2026-08-28T04:08:12.964214+00:00", "kind": "readme", "missing": false, "url": "https://github.com/WithSecureLabs/chainsaw"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 99, "longevity": 100, "rhythm": 99}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1846, "days_push": 8, "days_rel": 8, "gap_med": 11, "n_releases_24m": 18}, "score": 99, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}