{"adoption": {"forks": 488, "observed_at": "2026-08-28T04:07:49.756651+00:00", "stars": 3221}, "canonical_url": "https://ross.abutalabs.com/products/logontracer", "card": {"archived": false, "artifact_type": "application", "description": "Investigate malicious Windows logon by visualizing and analyzing Windows event log", "domain": ["security", "analytics", "developer-tools"], "enriched": true, "function": ["data-visualization", "security", "analytics", "search-engine"], "health_score": 95, "homepage": null, "language": "Python", "license": "NOASSERTION", "license_family": "other", "maturity": "active", "member_repos": ["JPCERTCC/LogonTracer"], "name": "JPCERTCC/LogonTracer", "platform": ["python", "self-hosted"], "pushed_at": "2026-08-02T02:31:38+00:00", "repo": "JPCERTCC/LogonTracer", "stars": 3221, "tags": ["dfir", "active-directory", "windows-event-log", "neo4j", "blueteam", "incident-response", "sigma-rules", "llm-analysis", "docker", "web-server"], "topics": ["security", "dfir", "javascript", "visualization", "active-directory", "event-log", "blueteam", "python-3"], "urls": [], "use_cases": ["investigate malicious windows logons", "visualize active directory event logs as a graph", "identify compromised accounts from event id 4624 and 4625", "analyze lateral movement in active directory", "scan evtx files with sigma rules", "map logon activity to mitre att&ck tactics"], "what_it_is": "LogonTracer is a self-hosted DFIR tool that visualizes Windows Active Directory logon-related event logs as a graph of hosts and accounts to investigate malicious logons. Version 2 adds AI-powered analysis with LLM agents, MITRE ATT&CK mapping, and Sigma rule scanning of EVTX files.", "when_to_avoid": ["you need real-time SIEM alerting rather than post-incident investigation", "you don't use Windows or Active Directory event logs", "you want a lightweight CLI without a Neo4j graph database dependency"], "when_to_choose": ["you need to trace which accounts and hosts were involved in suspicious logons", "you run Windows Active Directory and need DFIR visualization of event logs", "you want automated Sigma rule scanning of EVTX evidence", "you want AI-assisted threat assessment of logon graphs"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/logontracer", "repo": "JPCERTCC/LogonTracer", "role": "main", "score": 80}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:07:49.756651+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T18:44:20.322005+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "ae74af9c68186cb04d4ab2f6d1a94628c089e7d55b6a044a050ff09efd5591be", "fetched_at": "2026-08-28T04:07:49.756651+00:00", "kind": "readme", "missing": false, "url": "https://github.com/JPCERTCC/LogonTracer"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 95, "longevity": 100, "rhythm": 48}, "computed_at": "2026-09-03T02:39:23.370411+00:00", "flags": ["no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3204, "days_push": 32, "days_rel": 133, "gap_med": null, "n_releases_24m": 1}, "score": 80, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}