Python · MIT
helixmap/sigwood
Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.
★ 356
Stars
16 forks · 0 open issues
+3.6/day
Growth · measured
Stars counted between two of our own snapshots roughly a week apart. The repository page gives the exact span.
34.4
Momentum / 100
see the breakdown below
4mo ago
Created
last push 10d ago
Star history
How this score was built
| Component | Weight | Earned | Why |
|---|---|---|---|
| Velocity | 55 | 12.6 | +3.6/day, log-scaled against a 750/day ceiling |
| Acceleration | 15 | 0.0 | last week ran 0.60× the monthly pace |
| Freshness | 15 | 14.4 | last push 10d ago; decays to zero at 180 days |
| Scale | 15 | 7.4 | 356 stars, log-scaled against 150k — stops a 3-star repo topping the board |
| Momentum | 100 | 34.4 | sum of the above |
Detail
| Topics | anomaly-detectionblue-teamcloudtraildfirhomelabjournaldlog-analysisnetwork-securitypiholepythonsecurity-toolsself-hostedsyslogthreat-huntingzeek |
| Matched on | Security (security-tools) |
| Short window | +25 stars over 7 days = 3.6/day |
| Long window | +126 stars over 21 days = 6.0/day |
| Lifetime average | 3.01 stars/day over 118 days |
| First seen here | 2026-10-15 |
| Last read | 2d ago |