corelight Goto Github PK

go-zeek-broker-ws

A Go library for using zeek broker's websocket API

got_zoom

A Zeek package that detects Zoom logins and meeting joins

goxmldsig

Pure Go implementation of XML Digital Signatures

http-more-files-names

Add more filenames to files.log from HTTP requests

http-stalling-detector

Detect HTTP stalling attacks like slowloris with Bro

icanntld

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The source of the ICANN TLD's can be found here: https://publicsuffix.org/list/effective_tld_names.dat. The Trusted Domains list is a custom list, created by the user, to filter domains during searches.

json-streaming-logs

Bro script package to create JSON formatted logs to stream into data analysis systems.

json-tcp-lb

line based tcp load balancing proxy.

log-add-http-post-bodies

Add POST body excerpt to Bro's HTTP log

log-add-vlan-everywhere

Add VLAN tags to all Zeek logs

molecule-docker

my_stats

A Zeek package to log running package stats.

package-manager

A package manager for Zeek

petitpotam

phantom-playbooks

pingback

A Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.

plotcap

Plot packet and data rates over time given a PCAP file, with gnuplot.

pycommunityid

A Python implementation of the Community ID flow hashing standard

raspi-corelight

Corelight@Home script

redxor

Detection of Linux Malware C2 RedXOR - demonstration

ripple20

A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.

shell_scripts_cron

sigred

Detection of attempts to exploit Microsoft Windows DNS server via CVE-2020-1350 (AKA SIGRed)

softsensor-docker-prototype

Softsensor Docker prototype

suricata_exporter

A Prometheus Exporter for Suricata

threat-hunting-guide

top-dns

Top DNS Measurement for Bro

ubuntu-go-npm

zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

zeek-cheatsheets

Zeek Log Cheatsheets