zeek-spicy-wireguard

By corelight

A Wireguard VPN protocol analyzer, based on Spicy.

zeek-ssh-interesting-hostnames-with-known

By dopheide

This script replaces the default ssh/interesting-hostnames and reduces the number of asyncrhonous when() calls made by Zeek.

zeek-sumstats-counttable

By 0xxon

Two-dimensional buckets for sumstats (count occurences per $str).

zeek-tenzir

By tenzir

This package is the official Zeek integration for Tenzir.

zeek-test-package

By jsiwek

An example Zeek package for testing purposes.

zeek-tls-log-alternative

By 0xxon

"This package generates a file called tls.log. The difference from ssl.log is that it is much more focused on logging all kinds of protocol features. This can be interesting for academic purposes - or if one is just interested in more information about specific features used in local TLS traffic."

zeek-xor-exe-plugin

By corelight

A plugin to find Windows executables that have been XOR encoded.

zeekjs

By corelight

Experimental JavaScript support for Zeek.

zeekjs-misp

By awelzel

zeekjs-notice-slack

By pgaulon

Package extending the Notice Framework to include to send Notices via Slack webhooks.

zeekjs-notice-telegram

By corelight

Package that extends the Notice Framework to include `ACTION_TELEGRAM` for sending messages on notices over Telegram using ZeekJS.

zerologon

By corelight

Detects Zerologon (CVE-2020-1472) attempts and exploits.

ztest

By corelight

A Zeek Unit Testing Framework