0xrawsec/whids

Health v2 · maintenance only

Adoption not part of the score

1311 stars · 149 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

WHIDS is an open-source Endpoint Detection and Response (EDR) tool for Windows, built on the Gene detection engine to match Sysmon/ETW events against user-defined rules. It supports detection-driven artifact collection (files, registry, process memory) and can run standalone or with an EDR manager.

Use cases

• detect threats on windows endpoints
• open source edr alternative
• threat hunting with sysmon events
• collect forensic artifacts on detection
• incident response endpoint monitoring
• write custom detection rules for windows event logs

When to choose

• you need a transparent, open-source EDR on Windows endpoints
• you want near real-time artifact collection triggered by detections
• you rely on Sysmon/ETW telemetry and want flexible rule-based detection
• you need a standalone agent without a commercial management console

When to avoid

• you need protection for Linux or macOS hosts
• you require a commercially supported EDR with SLAs
• you cannot install Sysmon on the monitored hosts
• you need actively maintained software with recent releases

Facets

application · maturity maintenance

security monitoring alerting logging security windows developer-tools windows go edr ids threat-hunting dfir sysmon etw incident-response detection-engine

Member repositories

For agents

markdown · JSON · MCP: product_card(name="0xrawsec/whids")