Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐

Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.

Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, Kafka and Spark

Tenzir is the data pipeline engine for security teams.

This project is a SIEM with SIRP and Threat Intel, all in one.

Documentation for Zeek

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution serving all organizations.

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Extract files from network traffic with Zeek.

Zeek-Formatted Threat Intelligence Feeds

C++ parser generator for dissecting protocols & files.

Zeek IDS Dockerfile

A completely automated anomaly detector Zeek network flows files (conn.log).

Zeek's Messaging Library

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

DynamiteNSM is a free Network Security Monitor developed by Dynamite Analytics to enable network visibility and advanced cyber threat detection

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.