Kestrel

Open source

An open-source threat hunting language for building reusable, composable hunt flows across data sources.

by Open Cybersecurity AllianceOfficial site ↗Source code ↗

Pricing: free
License: open-source
Open source: Yes

Editorial review

Kestrel has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://kestrel.readthedocs.ioVerified
Tags(open-source;cloud-native): threat hunting, open source, STIX, hunt-flowVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hostedVerification pending

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerified
Source repository(HTTPS URL): https://github.com/opencybersecurityalliance/kestrel-langVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): composable and shareable hunt-flow language, abstraction over heterogeneous data sources, threat intelligence integration, forking and merging of hunt flows, STIX-shifter data source interface, Docker and OCI container deploymentVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending
CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Threat hunters building reusable, composable hunt-flows across heterogeneous data sources and threat intelVerification pending
Primary use cases(build;monitor;automate): threat hunting, hunt-flow sharing and reuse, custom analytics developmentVerification pending
Skill level(beginner;intermediate;advanced;specialist): specialistVerification pending

Lifecycle · Versioning

Changelog/release notes(HTTPS URL): https://github.com/opencybersecurityalliance/kestrel-lang/blob/develop/CHANGELOG.rstVerified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerified

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): consortiumVerification pending

User reviews

Review policy

No published reviews yet.