{"adoption": {"forks": 376, "observed_at": "2026-08-28T04:06:50.932694+00:00", "stars": 2428}, "canonical_url": "https://ross.abutalabs.com/products/deepbluecli", "card": {"archived": false, "artifact_type": "cli-tool", "description": null, "domain": ["security", "developer-tools"], "enriched": true, "function": ["security", "logging", "monitoring"], "health_score": 20, "homepage": null, "language": "PowerShell", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "maintenance", "member_repos": ["sans-blue-team/DeepBlueCLI"], "name": "sans-blue-team/DeepBlueCLI", "platform": ["windows", "cli"], "pushed_at": "2023-10-14T17:06:57+00:00", "repo": "sans-blue-team/DeepBlueCLI", "stars": 2428, "tags": ["threat-hunting", "windows-event-logs", "evtx", "powershell", "blue-team", "sysmon", "incident-response", "command-line"], "topics": [], "urls": [], "use_cases": ["hunt for threats in windows event logs", "analyze evtx files for malicious activity", "detect password spraying and brute force attempts", "find obfuscated powershell commands in logs", "detect mimikatz and event log tampering", "triage sysmon and security event logs during incident response"], "what_it_is": "DeepBlueCLI is a PowerShell module for threat hunting that analyzes Windows Event Logs (Security, System, Application, PowerShell, Sysmon) and EVTX files for suspicious activity. It detects malicious behaviors such as user creation, password spraying, obfuscated commands, Mimikatz usage, and event log manipulation.", "when_to_avoid": ["you need real-time, centralized, scalable log monitoring across many hosts", "you require alerting, dashboards, or long-term retention typical of a SIEM", "your environment is not Windows"], "when_to_choose": ["you are a blue teamer or incident responder analyzing Windows event logs offline or on-host", "you want a free, scriptable alternative to commercial SIEM detection rules for common attack patterns", "you need to process EVTX files from another machine without a full SIEM"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/deepbluecli", "repo": "sans-blue-team/DeepBlueCLI", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:50.932694+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:31:33.830154+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "f8116485911476cbe421cee3d40400d6f3fb49735a9e1ed8b8129978cbb1daea", "fetched_at": "2026-08-28T04:06:50.932694+00:00", "kind": "readme", "missing": false, "url": "https://github.com/sans-blue-team/DeepBlueCLI"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3634, "days_push": 1054, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}