bytedance / Elkeid
Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
- Stars
- 2,701 stars
- Forks
- 475 forks
- Language
- Go
- License
- Not reported
- Created
- Dec 18, 2020
- Last push
- Nov 12, 2026
- Updated
- Nov 11, 2026
Why these Tags: an agent read the README and quoted it
- Intrusion detection from the readme:
**HIDS (Host Intrusion Detection System)** ability for host layer intrusion detection and malicious file identification
An agent gave these Tags from the fixed Tag list in the AwesomeRepos source code. A code check kept each Tag only when its quote is in the text. A wrong Tag? Report an error with the form at the end of this page.
Admitted to the Repository Index on Nov 11, 2026: 2,700 stars on 2026-11-11.
Star History
186 days recorded, May 11, 2026 – Nov 12, 2026 (UTC). Net change +75 stars.
The star count of each day is the latest count minus the net stars of the later days.
Add this Star History to a README
The images follow the light or dark theme of the page that shows them, and update every hour.
Add ?theme=light or ?theme=dark
to the chart address to keep one theme.
Star History chart
[](https://awesomerepos.com/bytedance/Elkeid) Badge
[](https://awesomerepos.com/bytedance/Elkeid) Timeline
It gained stars on 56 of the 186 days recorded since May 11, 2026.
Its largest 7 days were Jun 4, 2026 to Jun 10, 2026: 7 stars.
In the 30 days to Nov 12, 2026 it got 19 stars, 111% more than in the 30 days before.
It had 2,626 stars before May 11, 2026 and has 2,701 stars now: 2,299 fewer than 5,000.
- Created on the Repository Host
- Release rasp-v2.2.4.9
- Release scanner-v2.2.0.1-20241203_4_test_only
- Release scanner-v2.2.0.1-20241217_1_test_only
- Release v1.7.0.22
- Release scanner-v2.2.0.2-20241226_1_test_only
- +2 stars in one day
- Largest star day recorded: +4 stars
- +3 stars in one day
- Entered the Repository Index: 2,700 stars on 2026-11-11
- Latest push
The timeline comes from the creation date and the releases on the Repository Host, the Admission, the Star History, and the Observations. Star milestones show only when the Star History records the day. The list shows up to 5 stable releases from the latest 10 releases recorded. When none of them is stable, one item counts the pre-releases. On the chart of net stars each day, a solid line marks each recorded release.
Forks and pushes
From 2 Observations, Nov 12, 2026 – Nov 13, 2026. Forks 0. AwesomeRepos saw a new push on 1 of 1 days.
- Nov 13, 2026: new push
A filled day: the last push time changed since the Observation before it.
Health facts
Measured facts in four separate dimensions, each with a date and a source. AwesomeRepos does not add them into one score. AwesomeRepos reads the weekly commits, the changelog, and the community files each week for the 5,000 visible repositories with the most stars and for each rising repository. How AwesomeRepos defines each check
Copies a prompt for a coding agent. It has 3 tasks for the maintainers of bytedance/Elkeid.
Improve the Health Facts of the GitHub repository bytedance/Elkeid. AwesomeRepos measures facts about how a repository is maintained, released, secured, and documented. Its page for this repository is https://awesomerepos.com/bytedance/Elkeid. A change to the repository can improve each of the 3 items below. Each item gives the measured fact or score, and a task. 1. A release in the last 365 days Fact: Newest release scanner-v2.2.0.2-20241226_1_test_only on 2024-12-26, 687 days ago. 0 releases in the last 365 days. Rule: The newest published GitHub release (a pre-release counts; a draft does not) is 365 days old or less. A repository that publishes only tags, or only to a package registry, has no GitHub release. The release refresh reads the 10 newest releases after each push to the repository, and at least each 30 days. The index refresh reads the date of the last push each day. Task: Prepare a release, but do not publish it. Find the changes since the newest release, propose the next semantic version and the release notes, and ask me to publish the GitHub release. If nothing changed since the newest release, skip this item. If the project publishes only to a package registry, add a CI step that also makes a GitHub release for each version tag. 2. The newest release tag is a semantic version Fact: The newest release tag is scanner-v2.2.0.2-20241226_1_test_only. Rule: The tag of the newest release has the form 1.2.3 or v1.2.3, with an optional pre-release or build part. There is no data when the repository has no release. Task: Make the next release tag a semantic version (1.2.3 or v1.2.3). Do not change or delete a published tag. If a release tool makes the tags, configure it for semantic versions, and write the version scheme in the contributing guide. 3. A licence Fact: GitHub finds no licence. Rule: GitHub finds a licence file. When GitHub cannot name the licence, the fact says so. Task: Ask me which licence to use. Do not choose one yourself. Then add the standard licence text as LICENSE at the root, so that GitHub can name the licence. Do not change the terms. Fill in only the fields of the template (for example the year and the copyright holder), and ask me for a value that you cannot verify. Rules for this work: - Each file must be true for this project. Do not copy text that does not apply to it. - Do not choose a licence, a contact, or a release version for me. Ask me. - Do not publish a release, change a repository setting, or push to the default branch. Make the changes on a new branch. - Keep each change small, and run the checks of this repository before you finish. - At the end, list each item as DONE, SKIPPED (with the reason), or NEEDS A DECISION (with the question). AwesomeRepos reads these facts again in its next scan. The definitions of the checks: https://awesomerepos.com/health-facts
Maintenance
2 of 4 checks (2 without data)-
Yes: Not archived
GitHub does not mark the repository as archived. Source
-
Yes: A push in the last 90 days
Last push on 2026-11-12, 1 day ago. Source
-
No data: Commits in the last 13 weeks
No data: AwesomeRepos has not read the weekly commits.
-
No data: Commits in 26 or more of the last 52 weeks
No data: AwesomeRepos has not read the weekly commits.
Releases
0 of 3 checks (1 without data)-
No: A release in the last 365 days
Newest release scanner-v2.2.0.2-20241226_1_test_only on 2024-12-26, 687 days ago. 0 releases in the last 365 days. Source
-
No: The newest release tag is a semantic version
The newest release tag is scanner-v2.2.0.2-20241226_1_test_only. Source
-
No data: A changelog file at the root
No data: AwesomeRepos has not scanned this repository.
Security practice
0 of 1 check (1 without data)-
No data: A security policy
No data: AwesomeRepos has not scanned this repository.
AwesomeRepos has not asked OpenSSF Scorecard about this repository.
Community files
0 of 3 checks (2 without data)-
No: A licence
GitHub finds no licence. Source
-
No data: A contributing guide
No data: AwesomeRepos has not scanned this repository.
-
No data: A code of conduct
No data: AwesomeRepos has not scanned this repository.
Dependencies in the index
This section shows the packages that connect this repository to other repositories in the index.
The GitHub dependency graph of this repository names 282 direct packages (scanned on Nov 13, 2026). Packages from 84 other repositories in the index are among them.
No scanned repository names a package from this repository.
Uses (in the index) · 84
- gin-gonic/gin 90K
Go: github.com/gin-gonic/gin
- spf13/cobra 45K
Go: github.com/spf13/cobra
- tokio-rs/tokio 34K
Cargo: tokio, tokio-util
- spf13/viper 31K
Go: github.com/spf13/viper
- rollup/rollup 26K
npm: rollup
- stretchr/testify 26K
Go: github.com/stretchr/testify
- uber-go/zap 25K
Go: go.uber.org/zap
-
npm: winston
- grpc/grpc-go 23K
Go: google.golang.org/grpc
-
Go: github.com/go-playground/validator/v10
Show all 84
- clap-rs/clap 17K
Cargo: clap
-
npm: ajv
- robfig/cron 14K
Go: github.com/robfig/cron/v3
- json-iterator/go 14K
Go: github.com/json-iterator/go
-
Cargo: windows
- IBM/sarama 13K
Go: github.com/ibm/sarama
- shirou/gopsutil 12K
Go: github.com/shirou/gopsutil/v3
-
Cargo: reqwest
- serde-rs/serde 11K
Cargo: serde
-
Go: github.com/fsnotify/fsnotify
- dgrijalva/jwt-go 11K
Go: github.com/dgrijalva/jwt-go
- golang/protobuf 10K
Go: github.com/golang/protobuf
- kubernetes/client-go 9.9K
Go: k8s.io/client-go
- golang-jwt/jwt 9.3K
Go: github.com/golang-jwt/jwt
-
GitHub Actions: actions/checkout
- patrickmn/go-cache 8.8K
Go: github.com/patrickmn/go-cache
-
Go: github.com/prometheus/alertmanager
-
Cargo: crossbeam, crossbeam-channel
-
Go: go.mongodb.org/mongo-driver
-
Go: github.com/mitchellh/mapstructure
- olivere/elastic 7.4K
Go: github.com/olivere/elastic/v7
- spf13/afero 6.7K
Go: github.com/spf13/afero
- dtolnay/anyhow 6.7K
Cargo: anyhow
-
Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
- google/uuid 6.2K
Go: github.com/google/uuid
-
Go: github.com/prometheus/client_golang
- rust-lang/futures-rs 5.9K
Cargo: futures, futures-util
- hashicorp/hcl 5.8K
Go: github.com/hashicorp/hcl
-
GitHub Actions: softprops/action-gh-release
- klauspost/compress 5.7K
Go: github.com/klauspost/compress
- serde-rs/json 5.7K
Cargo: serde_json
- gogo/protobuf 5.7K
Go: github.com/gogo/protobuf
- natefinch/lumberjack 5.5K
Go: github.com/natefinch/lumberjack
-
GitHub Actions: docker/build-push-action
- pest-parser/pest 5.4K
Cargo: pest, pest_derive
- coocood/freecache 5.4K
Go: github.com/coocood/freecache
-
Cargo: bindgen
- hashicorp/golang-lru 5.1K
Go: github.com/hashicorp/golang-lru
-
Go: github.com/burntsushi/toml
- tokio-rs/prost 4.8K
Cargo: prost
- deckarep/golang-set 4.8K
Go: github.com/deckarep/golang-set
-
Go: github.com/opencontainers/image-spec
- rs/xid 4.3K
Go: github.com/rs/xid
-
GitHub Actions: actions/upload-artifact
- rust-lang/regex 4.1K
Cargo: regex
- spf13/cast 4K
Go: github.com/spf13/cast
-
Cargo: chrono
- rollup/plugins 3.8K
npm: @rollup/plugin-commonjs, @rollup/plugin-json, @rollup/plugin-node-resolve
-
Go: github.com/opencontainers/runtime-spec
- Amanieu/parking_lot 3.5K
Cargo: parking_lot
- rcrowley/go-metrics 3.5K
Go: github.com/rcrowley/go-metrics
- vishvananda/netlink 3.3K
Go: github.com/vishvananda/netlink
- rust-cli/config-rs 3.2K
Cargo: config
- nix-rust/nix 3.1K
Cargo: nix
-
Cargo: protobuf-codegen-pure
- juju/ratelimit 2.9K
Go: github.com/juju/ratelimit
- spf13/pflag 2.8K
Go: github.com/spf13/pflag
- coreos/go-systemd 2.7K
Go: github.com/coreos/go-systemd/v22
- jessevdk/go-flags 2.7K
Go: github.com/jessevdk/go-flags
- rust-lang/libc 2.6K
Cargo: libc
- rust-lang/log 2.6K
Cargo: log
-
Go: github.com/eapache/go-resiliency
- onsi/gomega 2.4K
Go: github.com/onsi/gomega
- RustCrypto/hashes 2.3K
Cargo: sha2
- levigross/grequests 2.2K
Go: github.com/levigross/grequests
- muesli/cache2go 2.2K
Go: github.com/muesli/cache2go
-
Go: github.com/pelletier/go-toml
- DaGenix/rust-crypto 1.5K
Cargo: rust-crypto
- go-ole/go-ole 1.3K
Go: github.com/go-ole/go-ole
- jellydator/ttlcache 1.3K
Go: github.com/jellydator/ttlcache/v3
- godbus/dbus 1.2K
Go: github.com/godbus/dbus/v5
- rjeczalik/notify 938
Go: github.com/rjeczalik/notify
-
Go: gotest.tools/v3
- subosito/gotenv 311
Go: github.com/subosito/gotenv
Used by (in the index) · 0
None.
Sources: the GitHub dependency graph of each repository, and deps.dev for the source repository of each package (checked on Nov 12, 2026). A dependency graph also names development packages. deps.dev takes most source repositories from package metadata. How the dependency graph is made
Observations
Latest Observation, Nov 13, 2026: 2,701 stars, 475 forks, last push Nov 12, 2026, not archived. One of 2 Observations since Nov 12, 2026.