This script expands the base known-hosts policy to include reverse DNS queries and syncs it across all workers.
This script provides the ability to monitor and throw notices for outbound connections to a list of watched countries. It also adds orig and resp country codes to conn.log. It depends on having libmaxmind configured for GeoIP lookups.
This script expands the base known-services policy to include is_local_orig flag to indicate if the service was discovered from non-local nets (is_local_orig =F) or from local nets (is_local_orig=T).
Monitors for new domains being queried for and raises a notice for them
This script enables easy customation of how notice actions are handled. It's built to work with eZeekConfigurator, but that isn't required.
Package that extends the Notice Framework to include `ACTION_TELEGRAM` for sending messages on notices over Telegram.
This script just replaces the old ntp-monlist script to work with Zeek 3.0.0+