Owner
corelight
36 indexed repositories · View on GitHub
-
community-id-spec
An open standard for hashing network flows into identifiers, a.k.a "Community IDs".
Python · 197 stars
-
raspi-corelight
Corelight@Home script
Shell · 46 stars
-
zeek-community-id
Zeek support for Community ID flow hashing.
Zeek · 37 stars
-
cwrap
Auto wrap C and C++ functions with instrumentation
Perl · 34 stars
-
ecs-mapping
Mapping Corelight or Zeek data to Elastic Common Schema fields
33 stars
-
ripple20
A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.
Zeek · 32 stars
-
zeek-long-connections
Zeek package for tracking long connections to report them before they have completed.
Zeek · 31 stars
-
json-streaming-logs
Zeek package to create JSON formatted logs to stream into data analysis systems.
Zeek · 31 stars
-
suricata_exporter
A Prometheus Exporter for Suricata
Go · 27 stars
-
cve-2021-44228
Log4j Exploit Detection Logic for Zeek
Zeek · 19 stars
-
corelight-client
Corelight Sensor API command-line client
Python · 17 stars
-
json-tcp-lb
line based tcp load balancing proxy.
Go · 14 stars
-
zeek-quic
Bro analyzer that detects Google's QUIC protocol
JavaScript · 11 stars
-
ecs-logstash-mappings
Mapping Corelight or Zeek data to Elastic Common Schema logs
11 stars
-
top-dns
Top DNS Measurement for Bro
Zeek · 10 stars
-
zeek-spicy-openvpn
A Zeek OpenVPN protocol analyzer, based on Spicy.
Zeek · 9 stars
-
ecs-templates
Corelight or Zeek Elastic Common Schema Templates
Python · 9 stars
-
9 stars
-
zeekjs
ZeekJS - Experimental JavaScript support for Zeek.
C++ · 8 stars
-
zeek-openvpn
A Zeek OpenVPN protocol analyzer plugin.
JavaScript · 7 stars
- 16 more repositories live on View on GitHub
-
Zeekified Open
corelight/bro-protosigs#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/bro-hardware#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/top-dns#2 · 1 comment · 1 reaction · 0 assignees ·
-
corelight/zeek-quic#3 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-globload#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/ztest#2 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2021-38647#4 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2022-23270-PPTP#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/ripple20#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2022-24497#2 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2022-3602#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2022-24491#2 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/CVE-2022-24491#3 · 0 comments · 0 reactions · 0 assignees ·
-
Update to Zeek v4.1 Openenhancement
corelight/zeek-openvpn#4 · 0 comments · 0 reactions · 1 assignee ·
-
enhancement zeek-tweak
corelight/zeek-community-id#3 · 19 comments · 2 reactions · 0 assignees ·
-
enhancement good first issue
corelight/zeek-community-id#19 · 1 comment · 0 reactions · 0 assignees ·
-
corelight/plotcap#4 · 0 comments · 0 reactions · 0 assignees ·
-
ipv6 support Open
corelight/raspi-corelight#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/raspi-corelight#7 · 9 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-xor-exe-plugin#1 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/json-tcp-lb#7 · 0 comments · 0 reactions · 0 assignees ·
-
bug question spec-ambiguity
corelight/community-id-spec#3 · 3 comments · 0 reactions · 0 assignees ·
-
enhancement
corelight/community-id-spec#4 · 0 comments · 0 reactions · 0 assignees ·
-
question
corelight/community-id-spec#9 · 2 comments · 0 reactions · 0 assignees ·
-
Use case: anonymity Openusecase
corelight/community-id-spec#10 · 1 comment · 1 reaction · 0 assignees ·
-
enhancement
corelight/community-id-spec#11 · 1 comment · 0 reactions · 0 assignees ·
-
usecase
corelight/community-id-spec#13 · 0 comments · 1 reaction · 0 assignees ·
-
enhancement
corelight/community-id-spec#21 · 3 comments · 0 reactions · 0 assignees ·
-
corelight/community-id-spec#22 · 0 comments · 4 reactions · 0 assignees ·
-
enhancement
corelight/community-id-spec#23 · 0 comments · 0 reactions · 0 assignees ·
-
bug
corelight/community-id-spec#32 · 1 comment · 0 reactions · 1 assignee ·
-
enhancement spec-ambiguity
corelight/community-id-spec#33 · 3 comments · 0 reactions · 1 assignee ·
-
corelight/community-id-spec#34 · 0 comments · 0 reactions · 0 assignees ·
-
community ID decode Open
corelight/community-id-spec#36 · 1 comment · 0 reactions · 0 assignees ·
-
good first issue
corelight/go-zeek-broker-ws#2 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/go-zeek-broker-ws#3 · 0 comments · 0 reactions · 0 assignees ·
-
missing some rfc's OpenNeed PCAPs
corelight/zeek-spicy-stun#3 · 7 comments · 0 reactions · 0 assignees ·
-
enhancement
corelight/zeek-spicy-stun#6 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-asyncrat-detector#4 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-long-connections#14 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-long-connections#15 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/zeek-long-connections#16 · 0 comments · 1 reaction · 0 assignees ·
-
enhancement
corelight/cve-2021-44228#7 · 0 comments · 0 reactions · 0 assignees ·
-
enhancement
corelight/cve-2021-44228#8 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/cve-2021-44228#23 · 1 comment · 0 reactions · 0 assignees ·
-
DNS exfil regexes Openenhancement
corelight/cve-2021-44228#27 · 0 comments · 0 reactions · 0 assignees ·
-
LDAPS fingerprinting Openenhancement
corelight/cve-2021-44228#28 · 0 comments · 0 reactions · 0 assignees ·
-
corelight/cve-2021-44228#30 · 2 comments · 0 reactions · 0 assignees ·
-
corelight/cve-2021-44228#32 · 0 comments · 0 reactions · 0 assignees ·