{"adoption": {"forks": 184, "observed_at": "2026-08-28T04:04:42.285400+00:00", "stars": 1430}, "canonical_url": "https://ross.abutalabs.com/products/cisagov-sparrow", "card": {"archived": true, "artifact_type": "cli-tool", "description": "Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.", "domain": ["security", "cloud-computing", "developer-tools"], "enriched": true, "function": ["security", "monitoring", "developer-tools"], "health_score": 10, "homepage": null, "language": "PowerShell", "license": "CC0-1.0", "license_family": "permissive", "maturity": "abandoned", "member_repos": ["cisagov/Sparrow"], "name": "cisagov/Sparrow", "platform": ["windows", "cli", "cloud"], "pushed_at": "2022-12-27T14:54:45+00:00", "repo": "cisagov/Sparrow", "stars": 1430, "tags": ["azure", "m365", "incident-response", "forensics", "powershell", "threat-hunting", "solarwinds", "azure-ad", "unified-audit-log", "csv-export", "cisa", "archived"], "topics": [], "urls": [], "use_cases": ["detect compromised accounts in azure m365", "hunt for solarwinds-style identity attacks in my tenant", "audit azure ad service principals and graph api permissions", "check unified audit log for indicators of compromise", "investigate suspicious application activity in office 365", "export m365 audit findings to csv for analysis"], "what_it_is": "Sparrow.ps1 is a PowerShell script from CISA's Cloud Forensics team that helps incident responders detect possibly compromised accounts and applications in Azure/Microsoft 365 environments. It checks the unified audit log for indicators of compromise, lists Azure AD domains, and inspects service principals and Graph API permissions, exporting results to CSV files.", "when_to_avoid": ["you need actively maintained tooling - the repo was archived in December 2022 and is no longer maintained", "you require comprehensive cloud security monitoring beyond the narrow scope of federated identity and application attacks", "your tenant lacks the required E5/G5 license or unified audit logging, which some checks depend on"], "when_to_choose": ["you are an incident responder investigating identity or authentication-based attacks in an Azure/M365 tenant", "you need a read-only sweep of unified audit logs, Azure AD domains, and service principals", "you want CSV outputs you can feed into a dashboard like Aviary or analyze manually"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/cisagov-sparrow", "repo": "cisagov/Sparrow", "role": "main", "score": 10}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.285400+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:37:11.374170+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b1bf6b0ce1c84adc25e844a080c76af62d29d8a243020eece82363bd57728ea6", "fetched_at": "2026-08-28T04:04:42.285400+00:00", "kind": "readme", "missing": false, "url": "https://github.com/cisagov/Sparrow"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["archived"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2078, "days_push": 1345, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 10, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}