# airbnb/streamalert

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

Repository: https://github.com/airbnb/streamalert
Canonical: https://ross.abutalabs.com/products/streamalert
Homepage: https://streamalert.io
Language: Python
License: Apache-2.0
License Family: permissive
Topics: security, kinesis, serverless, terraform, lambda, aws, rules, analysis
Last push: 2023-10-23T17:15:34+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3511, "days_push": 1045, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2889, forks 324 (observed 2026-08-28T04:07:28.300419+00:00)

## What it is
StreamAlert is a serverless, real-time data analysis framework from Airbnb for ingesting, analyzing, and alerting on log data from any environment using AWS Lambda, Kinesis, and Terraform. Security teams use it to scan terabytes of log data daily for incident detection and response with Python-defined rules.

## Use cases
- detect security incidents in realtime log streams
- alert on suspicious activity in AWS logs
- scan terabytes of log data for threat detection
- ingest and classify logs from S3, Kinesis, and SNS
- write custom detection rules in Python
- retroactively search ingested logs for compliance

## When to choose
- you need serverless realtime log analysis on AWS
- your security team wants customizable Python detection rules
- you want automated, repeatable deployment via Terraform
- you need to scale log analysis to terabytes per day

## When to avoid
- you need multi-cloud or non-AWS deployment
- you want a turnkey SIEM with a UI rather than code-defined rules
- you need active community development - the project is in maintenance mode
- your log volume is small and a simpler alerting tool suffices

## Facets
- artifact type: framework
- maturity: maintenance
- function: monitoring, alerting, streaming, etl, security, infrastructure-as-code
- domain: security, monitoring, cloud-computing
- platform: cloud, python, serverless, self-hosted
- tags: log-analysis, incident-detection, kinesis, aws-lambda, terraform, threat-detection, realtime, devops, data-engineering

## Member repositories
- airbnb/streamalert (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:28.300419+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:48:17.596368+00:00, confidence not recorded.
  - readme: https://github.com/airbnb/streamalert (fetched 2026-08-28T04:07:28.300419+00:00, sha 0dfb2d49a57b)
  - homepage: https://streamalert.io (fetched 2026-08-29T09:51:32.357959+00:00, sha 4db000916cec)
- Data as of 2026-08-30T08:39:29.467469+00:00.