zeek

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

DynamiteNSM is a free Network Security Monitor to enable network visibility and advanced cyber threat detection

🔍 AI-assisted threat-hunting workbench for SOC and DFIR analysts — turns raw PCAPs into actionable intel with a Zeek + tshark pipeline, C2/beacon detection, JA3 fingerprinting, MITRE ATT&CK mapping, OSINT enrichment, and multilingual reports from local or cloud LLMs.

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

A completely automated anomaly detector Zeek network flows files (conn.log).

Read Zeek (Bro) logs into typed Python records; convert to JSON or CSV, map to Elastic Common Schema, load into Elasticsearch.

A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Extracts fields from zeek logs, compatible with zeek-cut

A configurable rule-based labeling tool for network flow files.

Device profile: Define acceptable amounts of traffic for your devices and see a report of outliers.

Scan extracted file from Zeek with Yara rules and get statistical analysis for matching files. Optionally, simulate matching malicious files with Picus.

Analyze Zeek IDS data with ksqlDB running on Confluent Platform via Docker on your laptop. Or spin up an arbitrary number of AWS hosts, each running Confluent Platform and ksqlDB for use in an instructor-led workshop.

Porting Suricata to Bro signatures

Templates for writing applications using Zeek NSM communication library Broker

DAM uses Faucet SDN controller to react based on Zeek IDS notification.