cisagov/CHIRP

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1058 stars · 94 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

CHIRP is a DFIR (Digital Forensics and Incident Response) tool by CISA that dynamically queries hosts for Indicators of Compromise (IoCs) using YARA rules and registry checks, outputting JSON for further SIEM analysis. It runs as a single package on live machines without modifying system data.

Use cases

• hunt for indicators of compromise on windows hosts
• scan a machine for yara rule matches during incident response
• collect ioc evidence as for siem ingestion
• run threat hunting against a specific CISA advisory like AA21-062A
• check registry artifacts for signs of compromise
• write custom indicators and plugins for threat hunting

When to choose

• you need a lightweight, read-only IOC sweep on a live host
• you want to hunt using CISA advisory indicators quickly
• you need JSON output for downstream SIEM analysis

When to avoid

• you need ongoing updates or support - the project is archived
• you need full forensic disk imaging or timeline analysis
• you need a real-time EDR or continuous monitoring solution

Facets

cli-tool · maturity abandoned

security search-engine developer-tools security developer-tools windows python cli dfir incident-response ioc yara threat-hunting cisa forensics command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cisagov/CHIRP")