Packages
By ncsa
ZeroMQ log writer.
By corelight
Identify bursty connections (large and fast)
By sethhall
Detect credit card numbers in HTTP and SMTP with Bro.
By initconf
package to detect CVE-2017-5638 struts attack
By srozb
Find and notice DNS zone transfer attempts.
By hhzzk
Detect DNS Tunnels attack.
By sethhall
A library for getting the "effective tld" of a domain name.
By dovehawk
MISP+Zeek. Dovehawk is a Zeek Module to import MISP indicators to the Intel Framework and Signature Framework automatically. Reports sightings directly back to MISP as they happen. Supports Zeek Clusters.
By dovehawk
Dovehawk.io Passive DNS Capture Module.
By dovehawk
Dovehawk Anonymized Outbound Flow Tracking
By hosom
Create dummy connection records.
By emojifier
Set your logs on fire with Emojifier!
By hosom
Extract files from network traffic with Bro.
By bricata
Provides mechanisms for managing and using institutional knowledge about a monitored environment to make informed observations of normal and abnormal network activity.
By salesforce
HASSH is used to identify specific Client and Server SSH implementations. The fingerprints can be stored, searched and shared in the form of an MD5 fingerprint. This package logs components to ssh.log
Page 3 of 6, showing 20 record(s) out of 112 total