ossec / ossec-rules
A repository for OSSEC rules and decoders
☆51Updated last year
Related projects: ⓘ
- How to Zeek Sysmon Logs!☆100Updated 2 years ago
- ☆52Updated 5 years ago
- Tool for managing Zeek deployments.☆53Updated last month
- ☆20Updated 4 years ago
- A Beat that monitors a local Nessus reports directory and outputs scan results to Elasticsearch or Logstash.☆31Updated 6 years ago
- This repository will hold PCAP IOC data related with known malware samples (owner: Bryant Smith)☆98Updated 3 years ago
- Mapping NSM rules to MITRE ATT&CK☆68Updated 4 years ago
- Useful resources for Zeek(https://zeek.org/) (Bro(http://bro.org/))☆31Updated 4 years ago
- Plugin for Zeek/Bro which provides http2 decoder/analyzer☆30Updated 3 months ago
- A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for…☆32Updated 2 years ago
- The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX accou…☆105Updated 4 months ago
- Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt☆36Updated last year
- Docker files for Security Onion☆38Updated 3 years ago
- Bro/Zeek integration with osquery☆95Updated 3 years ago
- YETI is a TAXII implementation☆46Updated 5 years ago
- A web-based tool to assist the work of the intuitive threat analysts.☆110Updated 5 years ago
- Zeek IDS Dockerfile☆99Updated last year
- Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings☆121Updated 3 years ago
- Centralize Management of Intrusion Detection System like Suricata Bro Ossec ...☆72Updated 5 years ago
- A tool to assess data quality, built on top of the awesome OSSEM.☆76Updated 2 years ago
- NMap XML decoding for logstash☆28Updated last year
- This project is no longer maintained. There's a successor at https://github.com/zeek-packages/zeek-agent-v2☆14Updated 3 years ago
- Extract files from network traffic with Zeek.☆99Updated 4 years ago
- ATT&CK Evaluations website (DEPRECATED)☆59Updated 3 years ago
- Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)☆94Updated 3 months ago
- Suricata rule and intel index☆28Updated last month
- Malware/IOC ingestion and processing engine☆102Updated 5 years ago
- Repository of yara rules☆57Updated last year
- Zeek package for tracking long connections to report them before they have completed.☆28Updated 2 years ago
- collector/runner☆65Updated 10 months ago