By zeek
A test package to verify that your Zeek installation can install packages successfully.
By corelight
A Zeek script using Input Framework to get icann_tld, icann_domain, icann_host_subdomain, and is_trusted_domain from a DNS query. The field icann_host_subdomain contains the remaining query nodes after the domain is removed. The is_trusted_domain is populated from a separate Input Framework set.
By sithari
Detects exfiltration of data over ICMP and writes to notice.log with the details of the exfil like duration, exfil size, source/dest ip, etc.
By cisagov
BACnet plugin for parsing and logging of the BACnet (building automation and control) protocol - CISA ICSNPP
By cisagov
BSAP over IP plugin for parsing and logging of the BSAP protocol - CISA ICSNPP
By cisagov
Ethernet/IP and CIP plugin for parsing and logging of the Ethernet/IP and CIP protocols - CISA ICSNPP
By cisagov
Ethercat plugin for parsing and logging of the Ethercat protocol - CISA ICSNPP
By cisagov
Genisys is a protocol defined by Union Switch & Signal for communicating with SCADA field devices, commonly used in the railway industry. It is similar in purpose to Modbus. Genisys was designed for use over serial connections, but is commonly transported over TCP as well. The protocol enables one client to communicate with one or more server devices over the same connection. The servers are identified by a one-octet server address. "Genisys" is a trademark of Union Switch & Signal.
By cisagov
OPC Unified Architecture Binary plugin for parsing and logging of the OPC UA Binary protocol - CISA ICSNPP
By cisagov
S7Comm & S7Comm Plus plugin for parsing and logging of the S7Comm, S7Comm Plus and COTP protocols - CISA ICSNPP
By cisagov
Synchrophasor (as defined in C37.118.2-2011 IEEE Standard for Synchrophasor Data Transfer for Power Systems) defines a simple and direct method of data transmission and accretion within a phasor measurement system.
By anthonykasza
An extension to the Intel Framework. This package faciliates the creation of rules which Zeek can monitor for.