{"adoption": {"forks": 220, "observed_at": "2026-08-28T04:06:59.199745+00:00", "stars": 2537}, "canonical_url": "https://ross.abutalabs.com/products/fibratus", "card": {"archived": false, "artifact_type": "application", "description": "Security sensor for realtime threat detection and protection", "domain": ["security", "windows", "developer-tools"], "enriched": true, "function": ["security", "monitoring", "alerting", "logging"], "health_score": 99, "homepage": "https://www.fibratus.io", "language": "Go", "license": "NOASSERTION", "license_family": "other", "maturity": "active", "member_repos": ["rabbitstack/fibratus"], "name": "rabbitstack/fibratus", "platform": ["windows"], "pushed_at": "2026-08-19T16:42:36+00:00", "repo": "rabbitstack/fibratus", "stars": 2537, "tags": ["edr", "threat-detection", "etw", "yara", "mitre-attack", "blueteam", "forensics", "kernel-telemetry"], "topics": ["windows", "windows-kernel", "instrumentation", "python", "golang", "security", "edr", "adversary", "blueteam", "etw", "mitre"], "urls": [], "use_cases": ["detect malware and attacker tradecraft on windows endpoints in realtime", "monitor process, file, registry and network activity via etw telemetry", "write behavioral detection rules mapped to mitre attack techniques", "scan process memory with yara for malicious payloads", "capture system events for forensic analysis", "forward security events to a siem or output sinks", "extend detection tooling with python filaments"], "what_it_is": "Fibratus is a Windows security sensor that performs realtime threat detection by analyzing kernel and system telemetry (including ETW events) against a behavior-driven rule engine and YARA memory scanner. It supports routing events to output sinks, writing capture files for forensics, and extending functionality via Python-based filaments.", "when_to_avoid": ["you need threat detection on linux or macos", "you want a fully managed commercial edr with vendor support", "your focus is network-only intrusion detection rather than endpoint telemetry"], "when_to_choose": ["you need an open-source edr-style sensor for windows hosts", "you want kernel-level telemetry with a flexible rule engine", "you need memory scanning and event capture for forensics on windows"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/fibratus", "repo": "rabbitstack/fibratus", "role": "main", "score": 90}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:59.199745+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:25:12.981644+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "20f8f32539c6460fa29720a6862627bf2ca3aa6f02838488431fbc9b4e51bb85", "fetched_at": "2026-08-28T04:06:59.199745+00:00", "kind": "readme", "missing": false, "url": "https://github.com/rabbitstack/fibratus"}, {"content_hash": "2e564700e8581e8fc11dbf72ffd7da8fba2149d106f33c7657a41715aa5433f9", "fetched_at": "2026-08-29T10:07:24.807052+00:00", "kind": "homepage", "missing": false, "url": "https://www.fibratus.io"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 98, "longevity": 100, "rhythm": 74}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3813, "days_push": 14, "days_rel": 14, "gap_med": 98.5, "n_releases_24m": 7}, "score": 90, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}