By dopheide
This script expands the base known-hosts policy to include reverse DNS queries and syncs it across all workers.
By dopheide
This script provides the ability to monitor and throw notices for outbound connections to a list of watched countries. It also adds orig and resp country codes to conn.log. It depends on having libmaxmind configured for GeoIP lookups.
This script expands the base known-services policy to include is_local_orig flag to indicate if the service was discovered from non-local nets (is_local_orig =F) or from local nets (is_local_orig=T).
By matchylabs
High-performance threat intelligence matching for Zeek using Matchy databases. Drop-in alternative to the Intel Framework with shared-memory databases and automatic hot-reload.
By corelight
TODO: A more detailed description of Mercury. It can span multiple lines, with this indentation.
By corelight
A Zeek base NetSupport detector. NetSupport is often abused by attackers in malware.
By rvictory
Monitors for new domains being queried for and raises a notice for them
By dopheide
This script enables easy customation of how notice actions are handled. It's built to work with eZeekConfigurator, but that isn't required.