{"adoption": {"forks": 94, "observed_at": "2026-08-28T04:03:25.183358+00:00", "stars": 1058}, "canonical_url": "https://ross.abutalabs.com/products/chirp", "card": {"archived": true, "artifact_type": "cli-tool", "description": "A DFIR tool written in Python.     ", "domain": ["security", "developer-tools"], "enriched": true, "function": ["security", "search-engine", "developer-tools"], "health_score": 10, "homepage": null, "language": "Python", "license": "CC0-1.0", "license_family": "permissive", "maturity": "abandoned", "member_repos": ["cisagov/CHIRP"], "name": "cisagov/CHIRP", "platform": ["windows", "python", "cli"], "pushed_at": "2021-06-09T20:12:04+00:00", "repo": "cisagov/CHIRP", "stars": 1058, "tags": ["dfir", "incident-response", "ioc", "yara", "threat-hunting", "cisa", "forensics", "command-line", "linux", "macos"], "topics": ["cisa", "python", "yara-python", "dfir", "cybersecurity", "ioc"], "urls": [], "use_cases": ["hunt for indicators of compromise on windows hosts", "scan a machine for yara rule matches during incident response", "collect ioc evidence as  for siem ingestion", "run threat hunting against a specific CISA advisory like AA21-062A", "check registry artifacts for signs of compromise", "write custom indicators and plugins for threat hunting"], "what_it_is": "CHIRP is a DFIR (Digital Forensics and Incident Response) tool by CISA that dynamically queries hosts for Indicators of Compromise (IoCs) using YARA rules and registry checks, outputting JSON for further SIEM analysis. It runs as a single package on live machines without modifying system data.", "when_to_avoid": ["you need ongoing updates or support - the project is archived", "you need full forensic disk imaging or timeline analysis", "you need a real-time EDR or continuous monitoring solution"], "when_to_choose": ["you need a lightweight, read-only IOC sweep on a live host", "you want to hunt using CISA advisory indicators quickly", "you need JSON output for downstream SIEM analysis"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/chirp", "repo": "cisagov/CHIRP", "role": "main", "score": 10}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:03:25.183358+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T06:57:45.663573+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f4c3110db1d882100ffaac0884e42efaa3ba4d4e5f5cb57c73f51c22282d9a86", "fetched_at": "2026-08-28T04:03:25.183358+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/CHIRP"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["archived"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1994, "days_push": 1911, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 10, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}