Alternatives and similar repositories for bro

Users that are interested in bro are comparing it to the libraries listed below

• thnyheim / misp2bro

  View on GitHub
  Python script that gets IOC from MISP and converts it into BRO intel files.
  ☆13Apr 17, 2016Updated 9 years ago
• PaloAltoNetworks / pan-stix

  View on GitHub
  pan-stix
  ☆19Oct 12, 2017Updated 8 years ago
• anthonykasza / beginner_brogramming

  View on GitHub
  scripts to help beginners program in Bro
  ☆21Aug 10, 2013Updated 12 years ago
• 0xxon / bro-scripts

  View on GitHub
  Assorted scripts for Bro
  ☆12Feb 8, 2016Updated 10 years ago
• fygrave / iocmap

  View on GitHub
  Indicator of Compromise Mapping Service
  ☆12Apr 15, 2014Updated 11 years ago
• jsiwek / bro_vetting

  View on GitHub
  Bro scripts to monitor for new hosts within a subnet range that aren't whitelisted/vetted.
  ☆13Jun 28, 2013Updated 12 years ago
• sooshie / bro-scripts

  View on GitHub
  Various Bro scripts
  ☆96Jul 8, 2016Updated 9 years ago
• corelight / Dashboards-Splunk-DNS-Hunting-Beaconing

  View on GitHub
  DNS Dashboard for hunting and identifying beaconing
  ☆16Jul 29, 2020Updated 5 years ago
• exp0se / bro-intel-generator

  View on GitHub
  Script for generating Bro intel files from pdf or html reports
  ☆77Dec 7, 2015Updated 10 years ago
• deependresearch / hoard

  View on GitHub
  Historical Observations of Actionable Reputation Data
  ☆13Jun 26, 2018Updated 7 years ago
• malware-kitten / bro_scripts

  View on GitHub
  A collection of bro_scripts and signatures
  ☆27Jun 26, 2019Updated 6 years ago
• paulpc / nyx

  View on GitHub
  Threat Intelligence distribution
  ☆31Dec 30, 2015Updated 10 years ago
• hosom / bro-scripts

  View on GitHub
  Bro stuff.
  ☆12May 24, 2016Updated 9 years ago
• mavam / brospects

  View on GitHub
  Experimental Bro scripts with good prospects for the official bro-scripts repository.
  ☆20Nov 2, 2017Updated 8 years ago
• set-element / auditdBroFramework

  View on GitHub
  The Auditd Framework logs and applies security policy to linux auditd data
  ☆15Jan 26, 2018Updated 8 years ago
• RyPeck / python-LEEF

  View on GitHub
  Python Module for creating Log Event Extended Format events for IBM QRadar
  ☆12Jun 4, 2016Updated 9 years ago
• carbonblack / cb-taxii-connector

  View on GitHub
  Connector for pulling and converting STIX information from TAXII Service Providers into CB Feeds.
  ☆15Jul 1, 2022Updated 3 years ago
• harvard-itsecurity / qradar-seculert-push

  View on GitHub
  Push "BAD" IPs/Networks into QRadar's "Remote Networks", tag them properly, and use them!
  ☆18Nov 5, 2013Updated 12 years ago
• lruppert / bro-scripts

  View on GitHub
  Utilities and scripts for bro-ids
  ☆23Jan 6, 2014Updated 12 years ago
• brianwarehime / goldphish

  View on GitHub
  A Maltego transform and machine to identify possible phishing vectors using permutated domains
  ☆15Oct 14, 2015Updated 10 years ago
• corelight / cve-2021-44228

  View on GitHub
  Log4j Exploit Detection Logic for Zeek
  ☆19Nov 25, 2025Updated 2 months ago
• jshlbrd / laikaboss-modules

  View on GitHub
  ☆17Nov 12, 2017Updated 8 years ago
• EmergingThreats / IDSDeathBlossom

  View on GitHub
  IDS Utility Belt For Automating/Testing Various Things
  ☆30Oct 14, 2020Updated 5 years ago
• hosom / bro-phishing

  View on GitHub
  Detect Phishing with Bro IDS
  ☆18Feb 1, 2017Updated 9 years ago
• jheise / threatcmd

  View on GitHub
  Cli interface to threatcrowd.org
  ☆20Jul 6, 2017Updated 8 years ago
• MITRECND / htpy

  View on GitHub
  Python bindings to libhtp
  ☆31Oct 13, 2020Updated 5 years ago
• grigorescu / bro-scripts

  View on GitHub
  Contributed Bro Scripts
  ☆30May 28, 2014Updated 11 years ago
• gcrahay / otx_misp

  View on GitHub
  Imports Alienvault OTX pulses to a MISP instance
  ☆53Sep 29, 2021Updated 4 years ago
• JustinAzoff / zeek-pdns

  View on GitHub
  Passive DNS collection using Zeek
  ☆182Jun 2, 2023Updated 2 years ago
• zeek / zeek-osquery

  View on GitHub
  Bro/Zeek integration with osquery
  ☆94Nov 2, 2020Updated 5 years ago
• micrictor / smbfp

  View on GitHub
  Zeek package to generate a SMB client fingerprint
  ☆27May 5, 2020Updated 5 years ago
• JustinAzoff / can-i-use-afpacket-fanout

  View on GitHub
  Validate if afpacket PACKET_FANOUT_HASH is working properly
  ☆25May 19, 2022Updated 3 years ago
• corelight / zeek-long-connections

  View on GitHub
  Zeek package for tracking long connections to report them before they have completed.
  ☆31Nov 25, 2025Updated 2 months ago
• coolacid / docker-snort

  View on GitHub
  Snort in a Docker Container
  ☆31Mar 21, 2014Updated 11 years ago
• zeek / bro-plugins

  View on GitHub
  (OBSOLETE) Plugins for Bro
  ☆53Sep 13, 2017Updated 8 years ago
• TravisFSmith / MyBroElk

  View on GitHub
  Scripts for Bro IDS and ELK Stack
  ☆57Sep 2, 2015Updated 10 years ago
• mixmodeai / bro_intel_linter

  View on GitHub
  Bro Intel Feed Linter
  ☆26Aug 30, 2019Updated 6 years ago
• corelight / json-streaming-logs

  View on GitHub
  Bro script package to create JSON formatted logs to stream into data analysis systems.
  ☆30Dec 3, 2025Updated 2 months ago
• hillar / CDMCS

  View on GitHub
  Cyber Defence Monitoring Course Suite :: Suricata, Bro, Moloch
  ☆61Feb 20, 2017Updated 8 years ago