This plugin adds support for shell-style glob patterns when loading Zeek scripts. For example, saying "@load startup.d/*.zeek" will load any Zeek scripts with a .zeek suffix from the startup.d folder.
This script expands the base known-hosts policy to include reverse DNS queries and syncs it across all workers.
This script provides the ability to monitor and throw notices for outbound connections to a list of watched countries. It also adds orig and resp country codes to conn.log. It depends on having libmaxmind configured for GeoIP lookups.
This script expands the base known-services policy to include is_local_orig flag to indicate if the service was discovered from non-local nets (is_local_orig =F) or from local nets (is_local_orig=T).
Monitors for new domains being queried for and raises a notice for them
This script enables easy customation of how notice actions are handled. It's built to work with eZeekConfigurator, but that isn't required.