Flowtriq DDoS Detection for Zeek

Detection Capabilities

• SYN Flood: Detects excessive new TCP connections from a single source
• UDP Flood: Detects excessive UDP traffic from a single source
• ICMP Flood: Detects excessive ICMP echo requests from a single source

Each detector uses configurable per-source thresholds with sliding measurement windows and per-source cooldowns to prevent alert fatigue.

Installation

Using the Zeek Package Manager:

zkg install zeek-flowtriq

Or install directly from the repository:

zkg install https://github.com/Flowtriq/zeek-flowtriq

Configuration

Add these settings to your local.zeek or a dedicated configuration file:

@load Flowtriq/DDoS

redef Flowtriq::webhook_url = "https://app.flowtriq.com/api/webhook/zeek";
redef Flowtriq::api_key = "your-api-key-here";

All configuration options live in Flowtriq:: namespace:

How It Works

The package monitors network events using Zeek's built-in connection and protocol event handlers. When packet counts from any single source exceed the configured thresholds within a measurement window, the package:

1. Fires a Flowtriq::ddos_detected event (available for custom handling)
2. Sends a JSON alert to your Flowtriq webhook via ActiveHTTP
3. Optionally raises a Zeek Notice (Flowtriq::SYN_Flood, etc.)

{
    "event": "ddos_alert",
    "attack_type": "syn_flood",
    "source_ip": "192.0.2.1",
    "packet_count": 1523,
    "window_seconds": 30,
    "detected_at": "1719400000.123456",
    "sensor": "sensor01.example.com"
}

event Flowtriq::ddos_detected(attack_type: string, src: addr,
                               packet_count: count, window: interval)
    {
    # Your custom handling here.
    }

Requirements

• Zeek 5.0 or later
• Network access from the Zeek sensor to the Flowtriq webhook endpoint

License

BSD 3-Clause. See LICENSE for details.