Zeek Log Cheatsheets

Terraform for Corelight's Azure Cloud Enrichment.

A JSON parser for Zeek.

Parse zeek logs and output as CSV

pre-commit hooks specification for zeek-format

Additional Kerberos Zeek logging; enabling policies that are not enabled by default

DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting -- fork of original scientific paper code

Monitor Zeek from Zabbix through Telemetry Framework (Prometheus)

Enrich the connections log with data from a CSV

Zeek parser for IEC 61850-8-1 MMS network protocol written in spicy

Zeek TSV log reader

Suppress SSL::Invalid_Server_Cert Zeek Notices

Zeek plugin Telecontrol Application Service Element 2 (TASE.2)/Inter-control Center Communications Protocol (ICCP)

Convert DER files to Zeek SSL::root_certs

Detection Engineering Lab Using Zeek, Elastic, and More

Package for generating the log schema for a given invocation of Zeek

Hybrid Cloud IDS 프로젝트

Terraform for Corelight's GCP Cloud Enrichment.

This POC is a lightweight anomaly detection pipeline designed for network environments using Zeek logs. It preprocesses network connections, trains a Random Forest classifier, and detects suspicious patterns automatically.

Zeek plugin for IEC 61850-goose written in Spicy