Packages

icsnpp-s7comm

By cisagov

S7Comm & S7Comm Plus plugin for parsing and logging of the S7Comm, S7Comm Plus and COTP protocols - CISA ICSNPP

icsnpp-synchrophasor

By cisagov

Synchrophasor (as defined in C37.118.2-2011 IEEE Standard for Synchrophasor Data Transfer for Power Systems) defines a simple and direct method of data transmission and accretion within a phasor measurement system.

igmp

By fdekeers

A Spicy-based packet analyzer for the IGMP protocol. Supports IGMPv1, v2 and v3.

indicator-rules

By anthonykasza

An extension to the Intel Framework. This package faciliates the creation of rules which Zeek can monitor for.

intel-expire

By j-gras

Per item expiration for Zeek's intelligence framework.

intel-extensions

By j-gras

Extensions for Zeek's intelligence framework.

intel-limiter

By j-gras

Limiter for Zeek's intelligence framework.

intel-seen-more

By j-gras

Additional seen-triggers for Zeek's intelligence framework.

ja3

By salesforce

JA3 creates 32 character SSL client fingerprints and logs them as a field in ssl.log. These fingerprints can easily be shared as threat intelligence or used as correlation items for enhanced alerting and analysis. This package also adds JA3 to the Zeek Intel Framework. https://github.com/salesforce/ja3

ja4

By foxio

A Zeek package which provides JA4+ network fingerprinting.

ja4

By anthonykasza

An implementation of the JA4 standard in a Zeek package.

Joe-Sandbox-Bro

By joesecurity

JoeSandbox-Bro extracts files from your internet connection and analyzes them automatically on Joe Sandbox. Combined with Joe Sandbox's reporting and alerting features you can build a powerful IDS.

json-streaming-logs

By corelight

JSON streaming logs

kyd

By fatemabw

KYD creates DHCP client hashes and logs the fingerprints and associated device information in a separate log file 'dhcpfp.log. The Unknown fingerprints can easily be queried to the Fingerbanks API using the 'dhcp-unknown.py' script provided in this package, resulting dhcp-db-extend output file can be appended to the local dhcp-db.bro, and also can be shared with the community using dhcp-db-FBQ file generated by the python script. https://github.com/fatemabw/kyd

LetsEncrypt

By initconf

LetsEncrypt

localcountry

By stevesmoot

TODO: A more detailed description of LocalCountry. It can span multiple lines, with this indentation.

log-add-http-post-bodies

By corelight

Add a POST body excerpt into the HTTP log

log-add-vlan-everywhere

By corelight

Add VLAN to all logs.

log-filters

By hosom

Implement common log filters.

log4j

By initconf

zeek package to identify log4j exploit attempts for CVE-2021-44228

Page 6 of 13, showing 20 record(s) out of 252 total