Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Bro IDS Dockerfile

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

A lightweight tool to score network traffic and flag anomalies

brostash: Linux distribution based on Debian and focusing on network security events collection

An Ubuntu 16.04 build containing Suricata, PulledPork, Bro, and Splunk

Materials for the BSides NoVA/Charleston 2018 Bro Workshop

Docker based Zeek IDS worker cluster

将bro日志输出到elk里面

BILA: BRO IDS Logs Analyzer

Porting Suricata to Bro signatures

Brostash Logstash pipeline

Simple logfile parser for Bro IDS

Look for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)

Bro IDS useful scripts

Malice Bro Plugin

Integration of Bro-IDS and ELK stack

OWAMP protocol analyzer plugin for Bro/Zeek

Module Bro NIDS for Probe Manager

🐦 A fluentd config for zeek