{"adoption": {"forks": 689, "observed_at": "2026-08-28T04:08:29.997604+00:00", "stars": 3931}, "canonical_url": "https://ross.abutalabs.com/products/helk", "card": {"archived": false, "artifact_type": "application", "description": "The Hunting ELK", "domain": ["security", "analytics", "big-data", "developer-tools"], "enriched": true, "function": ["search-engine", "data-visualization", "analytics", "machine-learning", "monitoring"], "health_score": 20, "homepage": null, "language": "Jupyter Notebook", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "experimental", "member_repos": ["Cyb3rWard0g/HELK"], "name": "Cyb3rWard0g/HELK", "platform": ["self-hosted"], "pushed_at": "2024-06-01T14:05:15+00:00", "repo": "Cyb3rWard0g/HELK", "stars": 3931, "tags": ["threat-hunting", "elk-stack", "elasticsearch", "kibana", "logstash", "apache-spark", "jupyter-notebook", "security-analytics", "hunt-platform", "docker", "linux"], "topics": ["hunting", "elasticsearch", "kibana", "logstash", "hunting-platforms", "elk", "elk-stack", "elastic", "docker", "jupyter-notebook", "threat-hunting", "spark", "dockerhub"], "urls": [], "use_cases": ["deploy a threat hunting platform quickly", "analyze security logs with Spark and Jupyter notebooks", "build a threat hunting lab for research", "run graph analytics on security event data", "test hunting use cases against Elasticsearch data", "explore security telemetry with SQL and Kibana"], "what_it_is": "The Hunting ELK (HELK) is an open-source threat hunting platform built on the ELK stack (Elasticsearch, Logstash, Kibana) with advanced analytics via Apache Spark, GraphFrames, and Jupyter notebooks. It is designed primarily for research and rapid deployment of hunt platforms for testing threat hunting use cases.", "when_to_avoid": ["you need a production-grade, battle-tested SIEM for large data volumes", "you require long-term support or stable releases, since the project is alpha and infrequently updated", "you only need basic log aggregation without advanced analytics"], "when_to_choose": ["you want a ready-made, Docker-based hunt platform for research or labs", "you need data science capabilities (Spark, GraphFrames, Jupyter) on top of an ELK stack", "you are learning or teaching threat hunting fundamentals"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/helk", "repo": "Cyb3rWard0g/HELK", "role": "main", "score": 23}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:08:29.997604+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T18:24:40.719467+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "a25245c67954ff739dcc806b2743c0bb75f2e8b82157532dc5620bc80c43fd73", "fetched_at": "2026-08-28T04:08:29.997604+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Cyb3rWard0g/HELK"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3459, "days_push": 823, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 23, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}