C2-detection-manjusaka
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
network-securitycommand-and-controlthreat-intelligence+3
6
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
corelight/community-id-specAn open standard for hashing network flows into identifiers, a.k.a "Community IDs".
corelight/conn-burstA Bro package to identify connections that are bursting (lots of data and transferring quickly).
corelight/corelightforcrowdstrikeCorelight app for CrowdStrike LogScale and Next-Gen SIEM
corelight/corelightforsplunk
corelight/elasticsearch_rulesElastic version of SOC prime watcher rules
corelight/icanntldZeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…
corelight/log-add-http-post-bodiesAdd POST body excerpt to Bro's HTTP log
corelight/raspi-corelightCorelight@Home script
corelight/top-dnsTop DNS Measurement for Bro
corelight/zeek-cheatsheetsZeek Log Cheatsheets
corelight/zeek-community-idZeek support for Community ID flow hashing.
corelight/zeek-cve-enrichment
corelight/zeek-endpoint-enrichment-connEnrich the conn.log with EDR data
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
corelight/zeek-openvpnA Zeek OpenVPN protocol analyzer plugin.
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol