A set of Zeek scripts to detect ATT&CK techniques.

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

How to Zeek Sysmon Logs!

GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor

Zeek network security monitor plugin that enables parsing of the Ethernet/IP and Common Industrial Protocol standards

A set of zeek scripts providing a module for tracking and correlating abnormal DNS behavior.

Zeek support for Community ID flow hashing.

Zeek package to detect CVE-2020-0601

Zeek network security monitor plugin that enables parsing of the Profinet protocol

Zeek network security monitor plugin that enables parsing of the BACnet standard building controls protocol

A Spicy protocol analyzer for WireGuard

Extracting and analyzing URLs from Emails for phishing events

Enables Zeek to communicate with Tenzir

Extensions for Zeek's Intelligence Framework.

Zeek Package that extracts features from IRC communication

Per item expiration for Zeek's intelligence framework.

ja3 ssl fingerprinting for bro

A Zeek (ex Bro) script to query the DroneBL's DNSBL database.

Binary Heap Implementation for Zeek

zeek-ssh-interesting-hostnames-with-known

Bro: Modified Misra-Gries Sumstats policy