Zeek Package Manager: Packages

"Community ID" flow hash support in conn.log

Discover and log information discovered in Microsoft DrWatson messages.

Scripts for cases where hardware device identifiers are discovered.

Find and log long-lived connections into a "conn_long" log.

Detects the Google QUIC (GQUIC) protocol and adds "gquic" to conn.log's "service" field.

Discover successful ShellShock attacks.

A plugin to find Windows executables that have been XOR encoded.

Identify bursty connections (large and fast)

Detect HTTP stalling attacks like slowloris.

JSON streaming logs

Add a POST body excerpt into the HTTP log

Add VLAN to all Bro logs.

Log the top DNS queries being requested.

Page 1 of 1, showing 13 record(s) out of 13 total