zeek-quic
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol
packet-sniffing-analysisnetwork-forensicsnetwork-security+2
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol
corelight/zeek2esA Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further…
corelight/corelightforsecopsChronicle parser for CORELIGHT and related information.
corelight/corelightforsentineloneCorelight Dashboards and Parsers for Sentinel One Singularity
corelight/extendintelThis package extends the Intel package to log more fields
corelight/suricata_exporterA Prometheus Exporter for Suricata
corelight/zeek-endpoint-enrichment
corelight/zeek-spicy-openvpnA Zeek OpenVPN protocol analyzer, based on Spicy.
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
zedocun/sharepoint-cve-2023-29375-incident-responseEnd-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.
corelight/ecs-mappingMapping Corelight or Zeek data to Elastic Common Schema fields
corelight/ecs-templatesCorelight or Zeek Elastic Common Schema Templates
chpratik/cve-2026-54121Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
viliuskraujutis/androidbroadcastsmonitorA tool to subscribe to receive all standard Android broadcasts on your Android device.
lethal-forensics/macos-collectormacos-collector - Automated Collection of macOS Forensic Artifacts for DFIR