{"adoption": {"forks": 299, "observed_at": "2026-08-28T04:04:21.818618+00:00", "stars": 1321}, "canonical_url": "https://ross.abutalabs.com/products/watchad", "card": {"archived": true, "artifact_type": "application", "description": "AD Security Intrusion Detection System", "domain": ["security", "monitoring", "self-hosted"], "enriched": true, "function": ["monitoring", "alerting", "security", "logging"], "health_score": 10, "homepage": null, "language": "Python", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "maintenance", "member_repos": ["Qianlitp/WatchAD"], "name": "Qianlitp/WatchAD", "platform": ["python", "self-hosted"], "pushed_at": "2023-03-31T14:42:00+00:00", "repo": "Qianlitp/WatchAD", "stars": 1321, "tags": ["active-directory", "intrusion-detection", "blue-team", "kerberos", "event-log-analysis", "ids", "linux", "docker"], "topics": ["security", "active-directory", "python3", "defcon27", "intrusion-detection-system", "kerberos", "event-log", "ntlm", "blue-team", "watchad"], "urls": [], "use_cases": ["detect kerberoasting and golden ticket attacks in active directory", "monitor domain controller event logs for intrusions", "detect ntlm relay and dcsync attacks", "set up honeypot accounts to catch attackers in AD", "blue team active directory threat detection", "detect privilege escalation and persistence in windows domains"], "what_it_is": "WatchAD is an open-source Active Directory security intrusion detection system that analyzes Windows event logs (and optionally Kerberos network traffic) from domain controllers to detect AD attacks. It covers detections across discovery, credential dumping, lateral movement, privilege escalation, persistence, and defense evasion using rule matching, honeypot accounts, and historical behavior analysis.", "when_to_avoid": ["you need the network-traffic-based (Kerberos traffic) detections, which are not included in the open-source release", "you need a actively developed tool - the project has seen limited recent activity", "your environment is not Windows Active Directory"], "when_to_choose": ["you run a Windows Active Directory environment and need open-source AD-specific intrusion detection", "you want detection coverage for common AD attack techniques like Kerberoasting, DCShadow, and Skeleton Key", "you are a blue team looking for free alternatives to commercial AD monitoring"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/watchad", "repo": "Qianlitp/WatchAD", "role": "main", "score": 10}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:21.818618+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:47:16.116922+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6362701e6cb50af01fe87d92218c3d6baba8b4cb66b6a4432641fe688ce78d1d", "fetched_at": "2026-08-28T04:04:21.818618+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Qianlitp/WatchAD"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases", "archived"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2505, "days_push": 1251, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 10, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}