Packages
By corelight
Detects the Google QUIC (GQUIC) protocol and adds "gquic"
to conn.log's "service" field.
By cybera
Sniffpass will alert on cleartext passwords discovered in HTTP POST requests
By corelight
A Facefish rootkit detector, based on Spicy.
By corelight
An IPSec Zeek protocol analyzer based on Spicy.
By corelight
A Zeek OpenVPN protocol analyzer, based on Spicy.
By corelight
A Zeek OSPF packet analyzer, based on Spicy.
By corelight
A Zeek STUN protocol analyzer based on Spicy.
By corelight
A Wireguard VPN protocol analyzer, based on Spicy.
By dopheide
This script replaces the default ssh/interesting-hostnames and reduces the number of asyncrhonous when() calls made by Zeek.
By corelight
A Zeek based STRRAT malware detector.
By 0xxon
Two-dimensional buckets for sumstats (count occurences per $str).
By tenzir
This package is the official Zeek integration for Tenzir.
By 0xxon
"This package generates a file called tls.log. The difference from ssl.log is that it is much more focused on logging all kinds of protocol features. This can be interesting for academic purposes - or if one is just interested in more information about specific features used in local TLS traffic."
By zeek
XDP traffic shunter
By corelight
A plugin to find Windows executables that have been XOR encoded.
By awelzel
A Zeekctl plugin that hooks install and start to run Zeek using systemd
By corelight
Experimental JavaScript support for Zeek.
Page 14 of 15, showing 20 record(s) out of 286 total
