forked from zeek/packages
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathaggregate.meta
1171 lines (1038 loc) · 40.4 KB
/
aggregate.meta
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
[0xxon/zeek-sumstats-counttable]
description = Two-dimensional buckets for sumstats (count occurences per $str).
tags = sumstats, summary statistics
test_command = cd tests && btest -d
url = https://github.com/0xxon/zeek-sumstats-counttable
version = 0.0.3
[0xxon/zeek-postgresql]
build_command = ( ./configure --bro-dist=%(bro_dist)s --with-postgresql-inc=`pg_config --includedir` --with-postgresql-server-inc=`pg_config --includedir-server` --with-postgresql-lib=`pg_config --libdir` && make )
description = A PostgreSQL reader and writer for Bro.
plugin_dir = build
tags = bro plugin, PostgreSQL, reader, writer, input
test_command = cd tests && btest -d
version = 0.0.6
url = https://github.com/0xxon/zeek-postgresql
[0xxon/zeek-plugin-roca]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Identify certificates potentially affected by CVE-2017-15361
plugin_dir = build/Johanna_ROCA.tgz
tags = certificates, CVE-2017-15361
test_command = cd tests && btest -d
url = https://github.com/0xxon/zeek-plugin-roca
version = 0.0.1
[0xxon/zeek-tls-log-alternative]
description = "This package generates a file called tls.log. The difference from ssl.log is that it is much more focused on logging all kinds of protocol features. This can be interesting for academic purposes - or if one is just interested in more information about specific features used in local TLS traffic."
script_dir = scripts
tags = TLS, SSL, X509, Certificates, PKI
test_command = cd tests && make
version = master
url = https://github.com/0xxon/zeek-tls-log-alternative
[0xxon/cve-2020-0601]
description = "Test script for CVE-2020-0601. Please read Readme."
script_dir = scripts
test_command = cd testing && btest -d
url = https://github.com/0xxon/cve-2020-0601
version = master
[0xxon/cve-2020-0601-plugin]
build_command = ( ./configure && make )
description = "Test script for CVE-2020-0601. Binary package, requires OpenSSL 1.1.x"
script_dir = scripts
test_command = cd testing && btest -d
url = https://github.com/0xxon/cve-2020-0601-plugin
version = master
[0xxon/cve-2020-13777]
description = "Test script for CVE-2020-13777. Please read Readme."
script_dir = scripts
test_command = cd testing && btest -d
url = https://github.com/0xxon/cve-2020-13777
version = master
[activecm/bro-mongodb.git]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
description = Bro IDS/ MongoDB connector.
tags = bro plugin, MongoDB, writer, security, conn, logging, rita
version = master
url = https://github.com/activecm/bro-mongodb.git
[activecm/bro-rita.git]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
description = RITA, Bro IDS connector.
tags = bro plugin, MongoDB, writer, security, conn, logging, rita
version = master
url = https://github.com/activecm/bro-rita.git
[amzn/zeek-plugin-bacnet]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = Plugin that enables parsing of the BACnet standard building controls protocol
script_dir = scripts
tags = zeek plugin, protocol analyzer, log writer, ics, bacnet
url = https://github.com/amzn/zeek-plugin-bacnet
version = master
[amzn/zeek-plugin-enip]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = Plugin that enables parsing of the Ethernet/IP and Common Industrial Protocol standards
script_dir = scripts
tags = zeek plugin, protocol analyzer, log writer, ics, enip, cip
url = https://github.com/amzn/zeek-plugin-enip
version = master
[amzn/zeek-plugin-profinet]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = Plugin that enables parsing of the Profinet protocol
script_dir = scripts
tags = zeek plugin, protocol analyzer, log writer, ics, profinet
url = https://github.com/amzn/zeek-plugin-profinet
version = master
[amzn/zeek-plugin-s7comm]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = Plugin that enables parsing of the S7 protocol
script_dir = scripts
tags = zeek plugin, protocol analyzer, log writer, ics, s7
url = https://github.com/amzn/zeek-plugin-s7comm
version = master
[amzn/zeek-plugin-tds]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = Plugin that enables parsing of the Tabular Data Stream (TDS) protocol
script_dir = scripts
tags = zeek plugin, protocol analyzer, log writer, tds
url = https://github.com/amzn/zeek-plugin-tds
version = master
[anthonykasza/indicator-rules]
depemds =
bro >= 2.6
description = An extension to the Intel Framework. This package faciliates the creation of rules which Zeek can monitor for.
script_dir = scripts
tags = intel, signature, indicators, pure-script
version = master
url = https://github.com/anthonykasza/indicator-rules
[apache/metron-bro-plugin-kafka]
build_command = ./configure --bro-dist=%(bro_dist)s --with-librdkafka=%(LIBRDKAFKA_ROOT)s && make
depends =
bro >=2.5.0
bro-pkg >=1.2
description = A Bro log writer plugin that sends logging output to Kafka.
external_depends =
librdkafka ~0.11.5
plugin_dir = build
script_dir = build/scripts/Apache/Kafka
tags = log writer, bro plugin, kafka
test_command = ( cd tests && btest -d )
user_vars =
LIBRDKAFKA_ROOT [/usr/local/lib] "Path to librdkafka installation tree"
version = 0.3
url = https://github.com/apache/metron-bro-plugin-kafka
[bricata/flow_labels]
description = Provides mechanisms for managing and using institutional knowledge about a monitored environment to make informed observations of normal and abnormal network activity.
tags = input, labels
url = https://github.com/bricata/flow_labels
version = master
[bro/bro-netmap]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Packet source plugin that provides native Netmap support.
plugin_dir = build
tags = packet source, plugin, netmap
test_command = ( cd tests && btest -d )
url = https://github.com/bro/bro-netmap
version = master
[corelight/bro-long-connections]
description = Find and log long-lived connections into a "conn_long" log.
script_dir = scripts
tags = conn
version = master
url = https://github.com/corelight/bro-long-connections
[corelight/bro-xor-exe-plugin]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = A plugin to find Windows executables that have been XOR encoded.
plugin_dir = build
tags = plugin, pe, executable, malware
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-xor-exe-plugin
version = 1.0
[corelight/bro-hardware]
description = Scripts for cases where hardware device identifiers are discovered.
script_dir = scripts
tags = hardware
version = master
url = https://github.com/corelight/bro-hardware
[corelight/bro-drwatson]
depends =
https://github.com/corelight/bro-hardware *
description = Discover and log information discovered in Microsoft DrWatson messages.
script_dir = scripts
tags = drwatson, http, windows
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-drwatson
version = master
[corelight/bro-shellshock]
description = Discover successful ShellShock attacks.
script_dir = scripts
tags = shellshock, detect, scripts
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-shellshock
version = master
[corelight/conn-burst]
description = Identify bursty connections (large and fast)
script_dir = scripts
tags = conn, burst
url = https://github.com/corelight/conn-burst
version = master
[corelight/log-add-http-post-bodies]
description = Add a POST body excerpt into the HTTP log
script_dir = scripts
tags = http log extend
version = master
url = https://github.com/corelight/log-add-http-post-bodies
[corelight/log-add-vlan-everywhere]
description = Add VLAN to all Bro logs.
script_dir = scripts
tags = log extend vlan
version = master
url = https://github.com/corelight/log-add-vlan-everywhere
[corelight/top-dns]
depends =
bro/sethhall/domain-tld *
description = Log the top DNS queries being requested.
script_dir = scripts
tags = dns, sumstats, log, measurement, top
url = https://github.com/corelight/top-dns
version = master
[corelight/json-streaming-logs]
description = JSON streaming logs
script_dir = scripts
tags = logs, json, streaming, stream, filebeat, splunk_forwarder, logstash
url = https://github.com/corelight/json-streaming-logs
version = master
[corelight/http-stalling-detector]
description = Detect HTTP stalling attacks like slowloris.
script_dir = scripts
tags = http, DoS, attack, notice
url = https://github.com/corelight/http-stalling-detector
version = master
[corelight/bro-quic]
build_command = test -e %(bro_dist)s/bro-path-dev.in && ( ./configure --bro-dist=%(bro_dist)s && make ) || ( ./configure && make )
description = Detects the Google QUIC (GQUIC) protocol and adds "gquic"
to conn.log's "service" field.
plugin_dir = build/Corelight_GQUIC.tgz
script_dir = build/scripts/Corelight/GQUIC
tags = plugin, analyzer, gquic, quic
url = https://github.com/corelight/bro-quic
version = v0.2
[corelight/icannTLD]
description = A Zeek script using Input Framework to get icann_tld, icann_domain, icann_host_subdomain, and is_trusted_domain from a DNS query. The field icann_host_subdomain contains the remaining query nodes after the domain is removed. The is_trusted_domain is populated from a separate Input Framework set.
script_dir = scripts
tags = domain, dns, tld, input
version = v19.0.0
url = https://github.com/corelight/icannTLD
[corelight/zeek-community-id]
build_command = ./configure && cd build && make
description = "Community ID" flow hash support in conn.log
script_dir = scripts/Corelight/CommunityID
tags = zeek plugin, conn, logging, community id, flow hashing, flow id, sha1, corelight
test_command = cd tests && btest -c btest.cfg -d communityid
url = https://github.com/corelight/zeek-community-id
version = 1.4
[corelight/zeek-elf]
build_command = ./configure --enable-debug --zeek-dist=%(zeek_dist)s && make
description = This package provides some basic analysis for ELF files.
script_dir = scripts/Zeek/ELF
tags = intel, files, elf
test_command = cd tests && btest
url = https://github.com/corelight/zeek-elf
version = v0.1.0
[corelight/zeek-jpeg]
build_command = ./configure --enable-debug --zeek-dist=%(zeek_dist)s && make
description = This package provides some basic analysis for JPEG files.
script_dir = scripts/Zeek/JPEG
tags = intel, files, jpeg, jpg
test_command = cd tests && btest
url = https://github.com/corelight/zeek-jpeg
version = v0.1.1
[corelight/zeek-macho]
build_command = ./configure --enable-debug --zeek-dist=%(zeek_dist)s && make
description = This package provides some basic analysis for Mach-o files.
script_dir = scripts/Zeek/MACHO
tags = intel, files, mach-o, macho
test_command = cd tests && btest
url = https://github.com/corelight/zeek-macho
version = v0.1.0
[corelight/got_zoom]
depends =
bro >=2.5.5
ja3 *
description = Detect Zoom traffic
script_dir = scripts
tags = TLS, SSL, JA3, Video conferencing, Video, Videoconferencing, Remote working, Zoom
version = master
url = https://github.com/corelight/got_zoom
[cybera/zeek-sniffpass]
description = Sniffpass will alert on cleartext passwords discovered in HTTP POST requests
script_dir = scripts
tags = password, logging
version = master
url = https://github.com/cybera/zeek-sniffpass
[dopheide/bro_notice_correlation]
description = Adds support for multi-notice correlation. For more information, see http://blog.samoehlert.com/correlating-bro-notices or the talk from BroCon 2016.
script_dir = scripts
tags = notices, notice, correlation
version = master
url = https://github.com/dopheide/bro_notice_correlation
[dopheide/venom]
description = Attempts to detect an attacker calling to the VENOM Linux Rootkit https://security.web.cern.ch/security/venom.shtml
script_dir = scripts
tags = Venom, venom, VENOM, rootkit
version = master
url = https://github.com/dopheide/venom
[dopheide/bro-quic]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Attempt to identify QUIC protocol
plugin_dir = build/Bro_QUIC.tgz
tags = plugin, analyzer, quic
url = https://github.com/dopheide-esnet/bro-quic
version = 0.1
[dopheide/zeek-ntp-monlist]
depends =
zeek >=3.0.0-rc1
description = This script just replaces the old ntp-monlist script to work with Zeek 3.0.0+
script_dir = scripts
tags = ntp, NTP, monlist, ddos
test_command = cd tests && btest -d ntp_tests
version = v1.0.2
url = https://github.com/dopheide-esnet/zeek-ntp-monlist
[dopheide/zeek-known-hosts-with-dns]
description = This script expands the base known-hosts policy to include reverse DNS queries and syncs it across all workers.
script_dir = scripts
tags = known-hosts, known_hosts, dns
test_command = cd tests && btest -d known_tests
version = v1.0.2
url = https://github.com/dopheide-esnet/zeek-known-hosts-with-dns
[dopheide/zeek-ssh-interesting-hostnames-with-known]
depends = https://github.com/dopheide-esnet/zeek-known-hosts-with-dns *
description = This script replaces the default ssh/interesting-hostnames and reduces the number of asyncrhonous when() calls made by Zeek.
script_dir = scripts
tags = dns, ssh, interesting-hostnames
test_command = cd tests && btest -d ssh_tests
version = v1.0.1
url = https://github.com/dopheide-esnet/zeek-ssh-interesting-hostnames-with-known
[dopheide/zeek-notice-config]
depends =
zeek >=3.0.0-rc1
description = This script enables easy customation of how notice actions are handled. It's built to work with eZeekConfigurator, but that isn't required.
script_dir = scripts
tags = notice, configuration, ezeekonfigurator, ezk
test_command = cd tests && btest -d notice_tests
version = master
url = https://github.com/dopheide-esnet/zeek-notice-config
[dopheide/zeek-known-outbound]
depends =
zeek >=3.0.0
description = This script provides the ability to monitor and throw notices for outbound connections to a list of watched countries. It also adds orig and resp country codes to conn.log. It depends on having libmaxmind configured for GeoIP lookups.
script_dir = scripts
tags = notice, known, services, outbound
test_command = cd tests && btest -d outbound-tests
version = master
url = https://github.com/dopheide-esnet/zeek-known-outbound
[dovehawk/dovehawk]
description = MISP+Zeek. Dovehawk is a Zeek Module to import MISP indicators to the Intel Framework and Signature Framework automatically. Reports sightings directly back to MISP as they happen. Supports Zeek Clusters.
script_dir = .
tags = intel, MISP, sightings, signatures, threat intelligence, threat intel, cyber
version = master
url = https://github.com/tylabs/dovehawk
[dovehawk/dovehawk_dns]
description = Dovehawk.io Passive DNS Capture Module.
script_dir = .
tags = dns, pdns, log, passive, dovehawk
url = https://github.com/tylabs/dovehawk_dns
version = master
[dovehawk/dovehawk_flow]
description = Dovehawk Anonymized Outbound Flow Tracking
script_dir = ./scripts/
tags = netflow, connections, log, remote, dovehwak
url = https://github.com/tylabs/dovehawk_flow
version = 1.0.0
[dw2102/S7Comm-Analyzer]
build_command = ./configure && make
credits = D. Wullen <[email protected]>
description = Protocol parser for the Siemens S7Comm and S7CommPlus protocol.
Both parser are based on the Iso-Over-TCP protocol. Not all functions are covered
in this analyzer, it may not capture all of the packets.
script_dir = scripts/
tags = s7comm, zeek plugin, s7commplus, siemens, zeek, protocol analyzer
version = master
url = https://github.com/dw2102/S7Comm-Analyzer
[emojifier/emojifier]
credits = Jan Grashoefer <[email protected]>,
Matthias Grundmann <[email protected]>,
Florian Jacob <[email protected]>
description = Set your logs on fire with Emojifier!
script_dir = scripts
tags = emoji, fire, emojifier
test_command = cd testing && btest -d
url = https://github.com/emojifier/emojifier
version = master
[endace/bro-dag]
build_command = ( ./configure && make )
description = Packet source plugin that provides native support for Endace DAG capture cards.
plugin_dir = build
tags = packet source, plugin, broctl plugin, dag, endace
test_command = ( cd tests && btest -d )
url = https://github.com/endace/bro-dag
version = v0.3.1
[esnet/zeek_perfsonar_owamp]
build_command = ( ./configure --zeek-dist=%(zeek_dist)s && make )
plugin_dir = build/PerfSONAR_OWAMP.tgz
tags = plugin, analyzer, owamp, perfsonar
test_command = cd tests && btest
url = https://github.com/esnet/zeek_perfsonar_owamp
version = master
[esnet/zeek-exporter]
build_command = ./configure && make
config_files = scripts/conf.dat
credits = Vlad Grigorescu <[email protected]>
depends =
zeek >=2.6.0
description = Prometheus exporter for Zeek performance data
external_depends =
cmake >=3.5
libcurl-devel *
plugin_dir = ./build/ESnet_Zeek_Exporter.tgz
script_dir = scripts/ESnet/Zeek_Exporter
tags = zeek plugin, performance, perf, stats, prometheus
test_command = cd tests && btest -d
url = https://github.com/esnet/zeek-exporter
version = 0.1.0
[fatemabw/bro-inventory-scripts]
description = Find different type of OSes and AV software in your network traffic.
script_dir = scripts
tags = OS detection, Anti-Virus
version = master
url = https://github.com/fatemabw/bro-inventory-scripts
[fatemabw/kyd]
description = KYD creates DHCP client hashes and logs the fingerprints and associated device information in a separate log file 'dhcpfp.log. The Unknown fingerprints can easily be queried to the Fingerbanks API using the 'dhcp-unknown.py' script provided in this package, resulting dhcp-db-extend output file can be appended to the local dhcp-db.bro, and also can be shared with the community using dhcp-db-FBQ file generated by the python script.
https://github.com/fatemabw/kyd
script_dir = zeek
tags = dhcp, dhcpfp
version = master
url = https://github.com/fatemabw/kyd
[hhzzk/dns-tunnels]
description = Detect DNS Tunnels attack.
script_dir = scripts
tags = DNS, DNS Tunnels, DNS Tunneling
version = master
url = https://github.com/hhzzk/dns-tunnels
[hosom/file-extraction]
config_files = scripts/config.zeek
depends =
zeek >=3.0.0
description = Extract files from network traffic with Zeek.
script_dir = scripts
tags = files, file extraction, file analysis
version = 2.0.3
url = https://github.com/hosom/file-extraction
[hosom/log-filters]
config_files = scripts/config.bro
depends =
bro >=2.5.0
description = Implement common log filters.
script_dir = scripts
tags = logging, log framework
version = master
url = https://github.com/hosom/log-filters
[hosom/bro-napatech]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
depends =
bro-pkg >=1.2
bro >=2.5.0
description = Packet source plugin that provides native support for NTAPI
plugin_dir = build/Bro_Napatech.tgz
tags = packet source, plugin, napatech, ntapi
url = https://github.com/hosom/bro-napatech
version = 0.1.0
[hosom/bro-oui]
depends =
bro >=2.5.5
description = Add OUI lookup to Bro.
script_dir = scripts
tags = oui, mac, dhcp
version = 1.0.3
url = https://github.com/hosom/bro-oui
[hosom/bro-ja3]
depends =
bro >=2.6.0
description = Generate and log ja3 ssl fingerprints
script_dir = scripts
tags = ja3, ssl, intel
test_command = cd tests && btest -d btests
version = 1.0.4
url = https://github.com/hosom/bro-ja3
[hosom/dummy-connections]
depends =
bro >=2.6.0
description = Create dummy connection records.
script_dir = scripts
tags = connection
version = 1.0.0
url = https://github.com/hosom/dummy-connections
[initconf/scan-NG]
description = scan detection in 2.x world. Forward porting of bro-1.5.3 scan.bro accompanied with new heuristics and quicker detections
script_dir = scripts
tags = scan detection
version = master
url = https://github.com/initconf/scan-NG
[initconf/CVE-2017-5638_struts]
description = package to detect CVE-2017-5638 struts attack
script_dir = scripts
tags = CVE-2017-5638, struts
version = master
url = https://github.com/initconf/CVE-2017-5638_struts
[initconf/phish-analysis]
description = Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
script_dir = scripts
tags = smtp, phish, urls, emails
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/phish-analysis
[initconf/smtp-url-analysis]
description = Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
script_dir = scripts
tags = smtp, phish, urls, emails
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/smtp-url-analysis
[initconf/blacklist]
description = package to manage blacklisted IP address ysing bro
script_dir = scripts
tags = blacklist
version = master
url = https://github.com/initconf/blacklist
[initconf/vnc-scanner]
description = Simple policy to detect VNC (RFB) scanners based on src->dst connection counts
script_dir = scripts
tags = rfb, vnc, osx high sierra
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/vnc-scanner
[initconf/ftp-bruteforce]
description = ftp-bruteforce
script_dir = scripts
tags = ftp, bruteforce, scan
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/ftp-bruteforce
[initconf/detect-kaspersky]
description = kaspersky
script_dir = scripts
tags = kaspersky antivirus
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/detect-kaspersky
[initconf/ws-discovery-dos]
description = udp-scan
script_dir = scripts
tags = ws-discovery, scan, dos, toshiba, copiers, scanners
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/ws-discovery-dos
[initconf/Apple-RDP-net-assistant-DoS.git]
description = udp-3283-DoS
script_dir = scripts
tags = net_listerner, Apple RDP, udp DoS
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/Apple-RDP-net-assistant-DoS.git
[irtimmer/bro-xdp_packet-plugin]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends =
bro-pkg >=1.2
bro >=2.5.0
description = This plugin provides native AF_XDP support for Bro.
plugin_dir = build/itimmer_af_xdp.tgz
tags = bro plugin, packet source, af_xdp
test_command = cd tests && btest -d
url = https://github.com/irtimmer/bro-xdp_packet-plugin
version = master
[j-gras/add-json]
depends =
zeek >=3.0
description = Additional JSON-logging for Zeek.
script_dir = scripts
tags = log, logging, JSON
test_command = cd tests && btest -d
url = https://github.com/J-Gras/add-json
version = 2.0.0
[j-gras/add-node-names]
depends =
zeek >=2.5
description = Adds cluster node name to logs.
script_dir = scripts
tags = log, logging, conn, add node name, add worker
url = https://github.com/J-Gras/add-node-names
version = 2.0.0
[j-gras/add-interfaces]
depends =
zeek >=3.0
description = Adds cluster node's interface to logs.
script_dir = scripts
tags = log, logging, conn, add interface, add worker
url = https://github.com/J-Gras/add-interfaces
version = 2.0.0
[j-gras/intel-extensions]
description = Extensions for Bro's intelligence framework.
script_dir = scripts
tags = intel, removal, preserve files
url = https://github.com/J-Gras/intel-extensions
version = v0.4.0
[j-gras/intel-seen-more]
description = Additional seen-triggers for Bro's intelligence framework.
script_dir = scripts
suggests =
sethhall/domain-tld *
tags = intel, seen
url = https://github.com/J-Gras/intel-seen-more
version = 0.3.1
[j-gras/intel-expire]
credits = Jan Grashoefer <[email protected]>
description = Per item expiration for Zeek's intelligence framework.
script_dir = scripts
tags = intel, expiration
test_command = cd testing && btest -d
url = https://github.com/J-Gras/intel-expire
version = master
[j-gras/intel-limiter]
credits = Jan Grashoefer <[email protected]>
description = Limiter for Zeek's intelligence framework.
script_dir = scripts
tags = intel, limits, threshold
test_command = cd testing && btest -d
url = https://github.com/J-Gras/intel-limiter
version = master
[j-gras/zeek-af_packet-plugin]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = This plugin provides native AF_Packet support for Zeek.
plugin_dir = build/Zeek_AF_Packet.tgz
tags = zeek plugin, zeekctl plugin, packet source, af_packet
test_command = cd tests && btest -d
url = https://github.com/J-Gras/zeek-af_packet-plugin
version = 2.0.0
[j-gras/bro-af_packet-plugin]
build_command = ./configure && make
depends =
zkg >=2.0
zeek >=3.0.0
description = This plugin provides native AF_Packet support for Zeek.
plugin_dir = build/Zeek_AF_Packet.tgz
tags = zeek plugin, zeekctl plugin, packet source, af_packet
test_command = cd tests && btest -d
url = https://github.com/J-Gras/bro-af_packet-plugin
version = 2.0.0
[j-gras/bro-lognorm]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends =
bro >=2.5.0
description = This plugin provides liblognorm integration for Bro.
plugin_dir = build
tags = bro plugin, liblognorm, syslog
test_command = cd tests && btest -d
url = https://github.com/J-Gras/bro-lognorm
version = 0.3.0
[j-gras/bro-fuzzy-hashing]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends =
bro >=2.5.0
description = This plugin provides fuzzy hashing for Bro.
plugin_dir = build/JGras_FuzzyHashing.tgz
tags = bro plugin
test_command = cd tests && btest -d
url = https://github.com/J-Gras/bro-fuzzy-hashing
version = 0.3.0
[jbaggs/anomalous-dns]
depends = https://github.com/sethhall/domain-tld *
description = A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.
tags = bro scripting, dns, domain, notices
version = 1.0.2
url = https://github.com/jbaggs/anomalous-dns
[jmellander/BinaryHeap]
description = Binary Heap Implementation
script_dir = scripts
tags = zeek, zeek.org, BinaryHeap
url = https://github.com/jmellander/BinaryHeap
version = master
[joesecurity/Joe-Sandbox-Bro]
description = JoeSandbox-Bro extracts files from your internet connection
and analyzes them automatically on Joe Sandbox. Combined with Joe Sandbox's
reporting and alerting features you can build a powerful IDS.
script_dir = scripts
tags = file analysis, sandbox, malware, virus
url = https://github.com/joesecurity/Joe-Sandbox-Bro
version = master
[jonzeolla/scan-sampling]
description = Modified version of scan.bro to add destination IP sampling.
script_dir = scripts
tags = sumstats
url = https://github.com/JonZeolla/scan-sampling
version = 0.1.0
[jsiwek/zeek-test-package]
aliases = zeek-test-package bro-test-package
build_command = cd plugin && ./configure && make
description = An example Zeek package for testing purposes.
plugin_dir = plugin/build
script_dir = plugin/scripts/Demo/Rot13
tags = example, test, bro plugin, broctl plugin, rot13, cipher
test_command = cd testing && btest -d tests
url = https://github.com/jsiwek/zeek-test-package
version = 1.0.8
[jsiwek/zeek-cryptomining]
aliases = zeek-cryptomining bro_bitcoin
depends = bro-pkg >=1.5.0
description = Detects Bitcoin, Litecoin, or other cryptocurrency
mining traffic that uses getwork, getblocktemplate, or Stratum mining
protocols over TCP or HTTP. This package used to be named "bro_bitcoin".
tags = signatures, bitcoin, mining, cryptocurrency, cryptomining, cryptocoin
test_command = cd testing && btest -d tests
url = https://github.com/jsiwek/zeek-cryptomining
version = master
[jsiwek/zeek-print-log-info]
depends = zeek >=3.0.0
description = Gathers and prints field descriptions for all Zeek logs.
The default output format is CSV files.
tags = log, logs, logging, introspection, csv
url = https://github.com/jsiwek/zeek-print-log-info
version = master
[jswaro/tcprs]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = TCP Retransmission and State Analyzer plugin for Bro.
plugin_dir = build
script_dir = scripts
tags = bro plugin, TCP, retransmission, connection state, conn, input reader, protocol analyzer
test_command = cd tests btest -d tcprs
url = https://github.com/jswaro/tcprs
version = 0.2.1
[justinazoff/zeek-jemalloc-profiling]
description = A broctl plugin that enables jemalloc profiling
plugin_dir = .
tags = broctl, jemalloc, profiling
url = https://github.com/JustinAzoff/zeek-jemalloc-profiling
version = master
[klehigh/find_smbv1]
depends =
bro >=2.5.0
description = find SMBv1 activity
script_dir = scripts
tags = smb, logging
url = https://github.com/klehigh/find_smbv1
version = 1.0.0
[lexibrent/zeek-EternalSafety]
description = EternalSafety is a Zeek/Bro package for detecting potentially-dangerous SMBv1 protocol violations that encapsulate bugs exploited by the infamous Eternal* family of Windows exploits. It is capable of detecting EternalBlue, EternalSynergy/EternalRomance, EternalChampion, and the DoublePulsar backdoor. However, rather than identifying these exploits via simple signature-matching, *EternalSafety* instead implements a set of SMBv1 protocol invariants that encapsulate techniques used by each Eternal* exploit to trigger bugs in unpatched Windows systems. EternalSafety accurately and reliably identifies the EternalBlue, EternalSynergy and EternalRomance exploits, and the DoublePulsar backdoor implant. Due to limitations in Zeek's SMBv1 support, it has limited support for detecting EternalChampion via signature-matching. EternalSafety also identifies a range of other protocol violations, such as the use of unimplemented/unused SMBv1 commands, server-initiated changes in values that may only be set by an SMBv1 client, and incorrect interleaving of transaction types.
script_dir = scripts
tags = SMB, Windows, attack, notice, Eternal, SMBv1, EternalBlue
test_command = cd tests && make test
version = master
url = https://github.com/lexibrent/zeek-EternalSafety
[micrictor/spl-spt]
credits = Michael Torres <[email protected]>
description = A package that creates a log for sequences of packet lengths and times,
allowing for new analytics based on these data features.
script_dir = scripts
tags = ssl, tls, spt, spl
url = https://github.com/micrictor/spl-spt
version = master
[micrictor/smbfp]
credits = Michael Torres <[email protected]>
description = A package to create a fingerprint of SMB clients
script_dir = scripts
tags = smb, fingerprint
url = https://github.com/micrictor/smbfp
version = master
[mitre-attack/bzar]
description = BZAR - Bro/Zeek ATT&CK-based Analytics and Reporting.
script_dir = scripts
tags = bzar, att&ck, attack, analytics, cyber analytics repository, car, smb, rpc, dce-rpc
url = https://github.com/mitre-attack/bzar
version = master
[mitre/icap]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends =
bro >=2.5.0
description = Internet Content Adaptation Protocol (ICAP) Analyzer for Bro and Zeek.
script_dir = scripts
tags = bro plugin, zeek plugin, protocol analyzer, internet content adaptation protocol, icap, https plain text
url = https://github.com/mitre/icap
version = master
[mitrecnd/bro-http2]
build_command = ./configure --zeek-dist=%(zeek_dist)s && make
depends =
zeek >=3.0.0
description = A HTTP2 protocol analyzer for the Zeek NSM.
external_depends =
libnghttp2>=1.11.0
libbrotlidec>=1.0.0
script_dir = scripts
tags = zeek plugin, protocol analyzer, http2, intel
test_command = make test
url = https://github.com/MITRECND/bro-http2
version = 0.5.0
[ncsa/bro-interface-setup]
description = A broctl plugin that helps you setup capture interfaces
plugin_dir = .
tags = bro plugin, interface, mtu
url = https://github.com/ncsa/bro-interface-setup
version = master
[ncsa/bro-doctor]
depends =
j-gras/add-node-names *
description = A broctl plugin that helps you troubleshoot common problems
For cluster-related checks, the package "add-node-names" is recommended.
plugin_dir = .
tags = broctl plugin, troubleshoot
url = https://github.com/ncsa/bro-doctor
version = 2.0.4
[ncsa/bro-is-darknet]
description = This plugin adds a Site::is_darknet function.
This is useful for scripts that track scan attempts or other probes.
It can handle purely dark address space as well as honeynet space.
script_dir = scripts
tags = bro plugin, site, darknet
test_command = (cd testing && btest -d)
url = https://github.com/ncsa/bro-is-darknet
version = 0.6
[ncsa/bro-simple-scan]
depends =
bro >=2.5.1
ncsa/bro-is-darknet >=0.6
description = Simple, high performance tcp scan detection
script_dir = scripts
tags = bro plugin, scan detection
test_command = (cd testing && btest -d)
url = https://github.com/ncsa/bro-simple-scan
version = 1.4
[ncsa/bro-zeromq-writer]
build_command = ./configure --bro-dist=%(bro_dist)s --with-zmq=%(ZEROMQ_PREFIX)s && make
description = ZeroMQ log writer.
external_depends =
zeromq >=3.2.0
script_dir = scripts/NCSA/ZeroMQWriter
tags = bro plugin, log writer, zeromq, zmq, 0mq, json
test_command = make test
user_vars =
ZEROMQ_PREFIX [/usr/local] "ZeroMQ install prefix"
url = https://github.com/ncsa/bro-zeromq-writer
version = master
[nskelsey/aaalm]
description = Tag and group devices based on a LAN's structure
script_dir = scripts
tags = topology, mapping, visualization, traceroute
version = master
url = https://github.com/nskelsey/aaalm
[ntop/bro-pf_ring]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Packet source plugin that provides native PF_RING support.
plugin_dir = build
script_dir = scripts
tags = packet source, plugin, pf_ring
test_command = ( cd tests && btest -d )
url = https://github.com/ntop/bro-pf_ring
version = master
[pgaulon/zeek-notice-slack]
aliases = zeek-notice-slack bro-notice-slack
description = Zeek Notices through Slack webhook
tags = zeek plugin, notices, slack webhook
url = https://github.com/pgaulon/zeek-notice-slack
version = 1.0.1
[precurse/zeek-httpattacks]
description = Checks for HTTP anomalies typically used for attacking.
script_dir = scripts
tags = http, detection
version = master
url = https://github.com/precurse/zeek-httpattacks
[reservoirlabs/fix-ascii]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = ASCII FIX analyzer package
script_dir = scripts/RLABS/FIX/
tags = bro plugin, bro analyzer, ASCII FIX protocol analyzer
url = https://github.com/reservoirlabs/fix-ascii
version = master
[reservoirlabs/fix-binary]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = binary FIX analyzer package
script_dir = scripts/RLABS/FIX_SBE
tags = bro plugin, bro analyzer, binary FIX protocol analyzer
url = https://github.com/reservoirlabs/fix-binary
version = master
[reservoirlabs/sflow]
build_command = ./configure --zeek-dist=%(zeek_dist)s && make
description = sFlow analyzer package
script_dir = scripts/RLABS/SFLOW/
tags = zeek plugin, zeek analyzer, sFlow protocol analyzer
url = https://github.com/reservoirlabs/sflow
version = master
[salesforce/ja3]
description = JA3 creates 32 character SSL client fingerprints and logs them as a field in ssl.log. These fingerprints can easily be shared as threat intelligence or used as correlation items for enhanced alerting and analysis. This package also adds JA3 to the Zeek Intel Framework.
https://github.com/salesforce/ja3
script_dir = zeek
tags = intel, ssl, logging
version = master
url = https://github.com/salesforce/ja3