{"adoption": {"forks": 657, "observed_at": "2026-08-28T04:07:44.262166+00:00", "stars": 3119}, "canonical_url": "https://ross.abutalabs.com/products/sysmon-modular", "card": {"archived": false, "artifact_type": "dataset", "description": "A repository of sysmon configuration modules", "domain": ["security", "windows", "developer-tools"], "enriched": true, "function": ["security", "monitoring", "configuration-management", "developer-tools"], "health_score": 78, "homepage": null, "language": "PowerShell", "license": "MIT", "license_family": "permissive", "maturity": "active", "member_repos": ["olafhartong/sysmon-modular"], "name": "olafhartong/sysmon-modular", "platform": ["windows"], "pushed_at": "2026-08-10T00:47:52+00:00", "repo": "olafhartong/sysmon-modular", "stars": 3119, "tags": ["sysmon", "dfir", "threat-hunting", "mitre-attack", "sysmon-config", "modular-config", "powershell", "security-tools", "event-logging"], "topics": ["sysmon", "dfir", "threat-hunting", "mitre-attack", "modular", "security-tools"], "urls": [], "use_cases": ["generate a custom sysmon configuration for my windows environment", "find a good starting sysmon config for threat hunting", "tune sysmon event logging with modular include/exclude rules", "map sysmon events to MITRE ATT&CK techniques", "build a verbose sysmon config for DFIR investigations"], "what_it_is": "A modular repository of Microsoft Sysmon configuration modules maintained in PowerShell, with scripts to generate custom sysmonconfig.xml files. It provides pre-generated default, default+, and verbose configurations mapped to MITRE ATT&CK for threat hunting and DFIR.", "when_to_avoid": ["you need an EDR or detection engine rather than a Sysmon config", "you want a drop-in production config without per-environment tuning", "you are not using Windows or Sysmon"], "when_to_choose": ["you run Sysmon on Windows and want a maintained, modular, MITRE-mapped configuration baseline", "you need to generate tailored Sysmon configs by merging your own modules", "you do threat hunting or DFIR and want richer event coverage"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sysmon-modular", "repo": "olafhartong/sysmon-modular", "role": "main", "score": 75}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:07:44.262166+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T18:45:58.829326+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50d76603295acb9b47c4e8eb22c5aa3aa6b5f5d1fc8aed8d626e2b411bd5edb7", "fetched_at": "2026-08-28T04:07:44.262166+00:00", "kind": "readme", "missing": false, "url": "https://github.com/olafhartong/sysmon-modular"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 96, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3154, "days_push": 24, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 75, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}