Zeek-Formatted Threat Intelligence Feeds

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

Zeek IDS Dockerfile

A completely automated anomaly detector Zeek network flows files (conn.log).

A Zeek script to generate features based on timing, volume and metadata for traffic classification.

Materials for the BSides NoVA/Charleston 2018 Bro Workshop

Docker based Zeek IDS worker cluster

Alpine Linux based Filebeat Docker Image

An operator which calls zeek to nix-ecosystem simply.

Templates for writing applications using Zeek NSM communication library Broker

A log parser for common zeek text logs in Golang.

Zeek IDS and Zeek-Broker Docker images

🐦 A fluentd config for zeek

OWAMP protocol analyzer plugin for Bro/Zeek

Deployment of Zeek on a Raspberry Pi 4B

JSON TCP stream importer for RITA and AC-Hunter

DoveHawk.io Anonymized Outgoing Partial Netflow

DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting -- fork of original scientific paper code

This repository has customised scripts of Zeek IDS.