Top 14 zeek open source projects

Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!

Zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

✭ 4,180

C++Zeek CMake Yacc shell Lex security dfir network-monitoring pcap bro nsm zeek

zeek-plugin-tds

Zeek network security monitor plugin that enables parsing of the Tabular Data Stream (TDS) protocol

✭ 19

Zeek javascript C++Dockerfile Makefile shell CMake zeek security-tools zeek-package

Zeek-Network-Security-Monitor

A Zeek Network Security Monitor tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.

✭ 38

Zeek pcap network hacking bro cybersecurity network-monitoring lesson network-security-monitoring network-analysis cyber cyber-security network-traffic network-security zeek cyber-threat-intelligence conn cyber-security-team zeek-instance

brimcap

Convert pcap files into richly-typed ZNG summary logs (Zeek, Suricata, and more)

✭ 22

go Makefile pcap suricata zeek brim-desktop

zeek2es

A Python application to filter and transfer Zeek logs to Elastic/OpenSearch. This app can also output pure JSON logs to stdout for further processing!

✭ 16

python shell elasticsearch kibana zeek opensearch

docker-zeek

Zeek IDS Dockerfile

✭ 82

Zeek Dockerfile Makefile shell docker elasticsearch kafka ids network-monitoring zeek zeek-ids

graylog-zeek-content-pack

BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to capture and index BRO/Zeek logs coming from a remote sensor.

✭ 18

graylog bro ids zeek security-onion graylog-content-pack

ivre

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!