By salesforce
Zeek-Sysmon contains a python script that will read in a file, parse JSON Windows Event Logs, generate Zeek events, and forward them to Zeek. Default Zeek-Sysmon scripts log output to files.
By salesforce
Protocol analyzer that detects, dissects, fingerprints, and logs GQUIC traffic
By corelight
HASSH is used to identify specific Client and Server SSH implementations. The fingerprints can be stored, searched and shared in the form of an MD5 fingerprint. This package logs components to ssh.log
By salesforce
JA3 creates 32 character SSL client fingerprints and logs them as a field in ssl.log. These fingerprints can easily be shared as threat intelligence or used as correlation items for enhanced alerting and analysis. This package also adds JA3 to the Zeek Intel Framework. https://github.com/salesforce/ja3
By theparanoids
The script will create a new log which will log the details which build the fingerprint and some additional information. The fingerprint is created by concatenating extracted fields from different data packets. https://github.com/yahoo/rdfp
By saiiman
This package offers the possibility of exfiltration detection through statistical analysis methods. For this purpose, all connections are added to a baseline, subdivided according to their source ip address and destination port. The baseline is then used to perform statistical anomaly detection. Anomalies in the baseline are considered as data exfiltrations. The severity of the anomaly is recorded using a score between 0 and 1.
Page 1 of 1, showing 9 record(s) out of 9 total