{"adoption": {"forks": 221, "observed_at": "2026-08-28T04:06:19.450703+00:00", "stars": 2153}, "canonical_url": "https://ross.abutalabs.com/products/sysmonforlinux", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Sysmon for Linux", "domain": ["security", "monitoring", "operating-systems", "developer-tools"], "enriched": true, "function": ["monitoring", "logging", "security"], "health_score": 94, "homepage": null, "language": "C", "license": "MIT", "license_family": "permissive", "maturity": "active", "member_repos": ["microsoft/SysmonForLinux"], "name": "microsoft/SysmonForLinux", "platform": [], "pushed_at": "2026-07-13T23:10:10+00:00", "repo": "microsoft/SysmonForLinux", "stars": 2153, "tags": ["sysinternals", "system-monitoring", "edr", "kernel", "event-logging", "threat-detection", "linux"], "topics": [], "urls": [], "use_cases": ["monitor process creation and termination on linux servers", "log network connections made by processes", "detect malware and intruder activity on linux hosts", "audit file system writes across reboots", "feed sysmon events into a SIEM for threat hunting"], "what_it_is": "Sysmon for Linux is a Sysinternals tool that monitors and logs system activity such as process lifetime, network connections, and file system writes. It uses advanced filtering to help identify malicious activity and understand how intruders and malware operate.", "when_to_avoid": ["you only need lightweight metrics rather than security-focused event logging", "you cannot install kernel-level monitoring components on the host", "you need a GUI-based monitoring solution"], "when_to_choose": ["you need detailed, configurable system activity telemetry on linux", "you want a windows Sysmon-equivalent for cross-platform detection engineering", "you are building security monitoring or detection rules for linux endpoints"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sysmonforlinux", "repo": "microsoft/SysmonForLinux", "role": "main", "score": 86}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:19.450703+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:50:38.252133+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6988380b0573dbfdf864abf2168923baca28cede0719de36cf9aa9535f121459", "fetched_at": "2026-08-28T04:06:19.450703+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/SysmonForLinux"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 92, "longevity": 100, "rhythm": 71}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2135, "days_push": 51, "days_rel": 118, "gap_med": 44, "n_releases_24m": 8}, "score": 86, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}