# cisagov/CHIRP

A DFIR tool written in Python.

Repository: https://github.com/cisagov/CHIRP
Canonical: https://ross.abutalabs.com/products/chirp
Language: Python
License: CC0-1.0
License Family: permissive
Topics: cisa, python, yara-python, dfir, cybersecurity, ioc
Archived: true
Last push: 2021-06-09T20:12:04+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1994, "days_push": 1911, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1058, forks 94 (observed 2026-08-28T04:03:25.183358+00:00)

## What it is
CHIRP is a DFIR (Digital Forensics and Incident Response) tool by CISA that dynamically queries hosts for Indicators of Compromise (IoCs) using YARA rules and registry checks, outputting JSON for further SIEM analysis. It runs as a single package on live machines without modifying system data.

## Use cases
- hunt for indicators of compromise on windows hosts
- scan a machine for yara rule matches during incident response
- collect ioc evidence as  for siem ingestion
- run threat hunting against a specific CISA advisory like AA21-062A
- check registry artifacts for signs of compromise
- write custom indicators and plugins for threat hunting

## When to choose
- you need a lightweight, read-only IOC sweep on a live host
- you want to hunt using CISA advisory indicators quickly
- you need JSON output for downstream SIEM analysis

## When to avoid
- you need ongoing updates or support - the project is archived
- you need full forensic disk imaging or timeline analysis
- you need a real-time EDR or continuous monitoring solution

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: security, search-engine, developer-tools
- domain: security, developer-tools
- platform: windows, python, cli
- tags: dfir, incident-response, ioc, yara, threat-hunting, cisa, forensics, command-line, linux, macos

## Member repositories
- cisagov/CHIRP (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:25.183358+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:57:45.663573+00:00, confidence not recorded.
  - readme: https://github.com/cisagov/CHIRP (fetched 2026-08-28T04:03:25.183358+00:00, sha f4c3110db1d8)
- Data as of 2026-08-30T08:39:29.467469+00:00.