By corelight
A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability) AKA BadNeighbor
By initconf
Zeek package to ingest MISP threat intelligence feeds and log matches in a JSON format suitable for SOC/SIEM consumption
By initconf
Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
By initconf
scan detection in 2.x world. Forward porting of bro-1.5.3 scan.bro accompanied with new heuristics and quicker detections
By initconf
Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
By initconf
Simple policy to detect VNC (RFB) scanners based on src->dst connection counts