{"adoption": {"forks": 209, "observed_at": "2026-08-28T04:05:18.261621+00:00", "stars": 1659}, "canonical_url": "https://ross.abutalabs.com/products/sysmontools", "card": {"archived": false, "artifact_type": "application", "description": "Utilities for Sysmon", "domain": ["security", "developer-tools", "windows"], "enriched": true, "function": ["logging", "monitoring", "data-visualization", "security"], "health_score": 83, "homepage": null, "language": "TypeScript", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "active", "member_repos": ["nshalabi/SysmonTools"], "name": "nshalabi/SysmonTools", "platform": ["windows", "cross-platform"], "pushed_at": "2026-04-04T01:53:13+00:00", "repo": "nshalabi/SysmonTools", "stars": 1659, "tags": ["sysmon", "dfir", "threat-hunting", "threat-intelligence", "log-analysis", "electron", "security-analytics", "desktop"], "topics": ["sysmon", "threatintel", "sysinternals", "threat-hunting", "windows", "netsec", "monitoring", "logging", "threat-intelligence"], "urls": [], "use_cases": ["visualize sysmon logs as interactive process session diagrams", "correlate sysmon events by process guid and session", "investigate suspicious command lines and network connections from sysmon data", "filter and pin events of interest during threat hunting", "map external ip addresses from sysmon logs with geoip", "look up hashes and ips on virustotal during incident response", "group and explore large sysmon event datasets by machine or event type"], "what_it_is": "Sysmon Tools is a collection of utilities for analyzing, visualizing, and managing Microsoft Sysmon logs, centered on Sysmon View, an open-source Electron desktop app. It correlates Sysmon events into interactive process session diagrams, event views, and GeoIP maps for security analysts and threat hunters.", "when_to_avoid": ["you need automated, headless sysmon log collection or alerting pipelines", "your primary platform is Linux or macOS and you cannot run a Windows-first desktop app", "you need a SIEM-scale solution for centralized enterprise log management"], "when_to_choose": ["you are a DFIR analyst or threat hunter working with Microsoft Sysmon logs on Windows", "you need a free, open-source GUI to explore and visualize sysmon event data", "you want quick VirusTotal and GeoIP enrichment of sysmon indicators"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sysmontools", "repo": "nshalabi/SysmonTools", "role": "main", "score": 81}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:18.261621+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:44:42.835486+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "c5a0a4915250a279546570e53492915dc5c72b5a54fa68a7492794198382fabc", "fetched_at": "2026-08-28T04:05:18.261621+00:00", "kind": "readme", "missing": false, "url": "https://github.com/nshalabi/SysmonTools"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 75, "longevity": 100, "rhythm": 77}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3371, "days_push": 152, "days_rel": 152, "gap_med": 1, "n_releases_24m": 4}, "score": 81, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}