Zeek-Formatted Threat Intelligence Feeds

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.

Documentation for Zeek

Convert pcap files into richly-typed ZNG summary logs (Zeek, Suricata, and more)

Open source security data pipelines.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Terraform for Corelight's AWS Cloud Sensor Deployment.

Terraform for Corelight's Sensor Configuration.

Repository for configuration files, scripts, code, and other information on the Watchtower Stack

Terraform for Corelight's GCP Cloud Sensor Deployment.

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution serving all organizations.

C++ parser generator for dissecting protocols & files.

Terraform for Corelight's GCP Cloud Enrichment.

Terraform for Corelight's AWS Cloud Enrichment.

Terraform for Corelight's Azure Cloud Enrichment.

Terraform for Corelight's Azure Cloud Sensor Deployment.

Language server for Zeek script

Zeek TSV log reader

Threat Hunting Toolkit is a Swiss Army knife for threat hunting, log processing, and security-focused data science