Zeek-Formatted Threat Intelligence Feeds

Repository for configuration files, scripts, code, and other information on the Watchtower Stack

Tenzir is the data pipeline engine for security teams.

Threat Hunting Toolkit is a Swiss Army knife for threat hunting, log processing, and security-focused data science

Argus clients program repo

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Documentation for Zeek

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution serving all organizations.

C++ parser generator for dissecting protocols & files.

setup zeek, previously Bro IDS

Language server for Zeek script

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

ZeekJS - Experimental JavaScript support for Zeek.

Terraform for Corelight's Azure Cloud Sensor Deployment.

Terraform for Corelight's GCP Cloud Sensor Deployment.

Terraform for Corelight's AWS Cloud Sensor Deployment.