Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Network recon framework.

Desktop application to efficiently search large packet captures and Zeek logs.

Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, and Spark

🚌 The missing link to connect open-source threat intelligence tools.

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

Extract files from network traffic with Zeek.

Dynamite-NSM is a free Network Security Monitor developed by Dynamite Analytics on top of several leading, enterprise-grade technologies.

Bro IDS + ELK Stack to detect and block data exfiltration

Zeek IDS Dockerfile

Zeek network security monitor plugin that enables parsing of the Ethernet/IP and Common Industrial Protocol standards

Zeek ( formerly Bro) Network Security Monitor package for pfSense router/firewall

Documentation for Zeek

Generate network maps from packet captures

BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to capture and index BRO/Zeek logs coming from a remote sensor.

Zeek network security monitor plugin that enables parsing of the S7 protocol

Zeek network security monitor plugin that enables parsing of the BACnet standard building controls protocol

Materials for the BSides NoVA/Charleston 2018 Bro Workshop

Zeek network security monitor plugin that enables parsing of the Tabular Data Stream (TDS) protocol

Device profile: Define acceptable amounts of traffic for your devices and see a report of outliers.

Alpine Linux based Filebeat Docker Image

A Zeek ELF File Analyzer

setup zeek, previously Bro IDS

A Spicy protocol analyzer for WireGuard

A saltstack formula to install BRO network security monitor on RHEL or Debian based systems

CanCyber Zeek Module for network threat hunting

A Zeek Network Security Monitor Tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.

Docker based Zeek IDS worker cluster

💡 Enhance Zeek with MAC address ages

A Zeek Mach-o File Analyzer