Zeek Package Manager: Packages

aaalm

By nskelsey

Tag and group devices based on a LAN's structure

add-interfaces

By j-gras

Adds cluster node's interface to logs.

add-json

By j-gras

Additional JSON-logging for Zeek.

add-node-names

By j-gras

Adds cluster node name to logs.

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

appid

By stevesmoot

Leverage nDPI and other info to make informed guess at the application for a connection.

Apple-RDP-net-assistant-DoS

By initconf

udp-3283-DoS

bad-asn

By amarokinc

Adds ASN reputation data of external IP addresses to notice.log if the ASN crosses a predetermined threshold as defined by circl.lu

BinaryHeap

By jmellander

Binary Heap Implementation

blacklist

By initconf

package to manage blacklisted IP address ysing bro

bro_notice_correlation

By dopheide

Adds support for multi-notice correlation. For more information, see http://blog.samoehlert.com/correlating-bro-notices or the talk from BroCon 2016.

bro-af_packet-plugin

By j-gras

This plugin provides native AF_Packet support for Zeek.

bro-dag

By endace

Packet source plugin that provides native support for Endace DAG capture cards.

bro-doctor

By ncsa

A broctl plugin that helps you troubleshoot common problems For cluster-related checks, the package "add-node-names" is recommended.

bro-drwatson

By corelight

Discover and log information discovered in Microsoft DrWatson messages.

bro-fuzzy-hashing

By j-gras

This plugin provides fuzzy hashing for Bro.

bro-hardware

By corelight

Scripts for cases where hardware device identifiers are discovered.

bro-http2

By mitrecnd

A HTTP2 protocol analyzer for the Zeek NSM.

bro-interface-setup

By ncsa

A broctl plugin that helps you setup capture interfaces

bro-inventory-scripts

By fatemabw

Find different type of OSes and AV software in your network traffic.