{"adoption": {"forks": 185, "observed_at": "2026-08-28T04:04:42.999839+00:00", "stars": 1431}, "canonical_url": "https://ross.abutalabs.com/products/sysmoncommunityguide", "card": {"archived": false, "artifact_type": "learning-resource", "description": "TrustedSec Sysinternals Sysmon Community Guide", "domain": ["security", "windows", "developer-tools"], "enriched": true, "function": ["security", "monitoring", "documentation"], "health_score": 90, "homepage": null, "language": "Python", "license": null, "license_family": "other", "maturity": "active", "member_repos": ["trustedsec/SysmonCommunityGuide"], "name": "trustedsec/SysmonCommunityGuide", "platform": ["windows", "cross-platform"], "pushed_at": "2026-06-30T10:13:45+00:00", "repo": "trustedsec/SysmonCommunityGuide", "stars": 1431, "tags": ["sysmon", "sysinternals", "detection-engineering", "threat-hunting", "community-guide", "endpoint-monitoring", "siem", "linux"], "topics": [], "urls": [], "use_cases": ["learn how to install and configure Sysmon on Windows", "understand Sysmon event types like process creation and registry actions", "set up Sysmon on Linux with eBPF", "write better Sysmon configuration files for threat detection", "learn detection engineering fundamentals with Sysmon telemetry", "find documentation on Sysmon network and DNS events"], "what_it_is": "A community-maintained guide by TrustedSec covering Microsoft Sysinternals Sysmon on Windows and Linux, including installation, configuration, event types, and detection engineering fundamentals. It is licensed under Creative Commons BY-SA and serves as reference documentation rather than a software tool.", "when_to_avoid": ["you need a runnable tool or script rather than documentation", "you need vendor-official Microsoft documentation or support", "you need a general-purpose EDR or SIEM product"], "when_to_choose": ["you are a security engineer or threat hunter deploying or tuning Sysmon", "you need a free, community-driven reference for Sysmon event IDs and configuration", "you want to learn detection engineering using endpoint telemetry"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sysmoncommunityguide", "repo": "trustedsec/SysmonCommunityGuide", "role": "main", "score": 71}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:42.999839+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:37:09.271935+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "44101ebbbeb5a765d3b5cbde4f3d9e0125c0b3c6ec6a5354c06ce27de38952a5", "fetched_at": "2026-08-28T04:04:42.999839+00:00", "kind": "readme", "missing": false, "url": "https://github.com/trustedsec/SysmonCommunityGuide"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 90, "longevity": 100, "rhythm": 29}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2415, "days_push": 64, "days_rel": 261, "gap_med": null, "n_releases_24m": 1}, "score": 71, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}