Repositories list

• zeekjs

  Public
  ZeekJS - Experimental JavaScript support for Zeek.

  nodejsjavascriptv8+ 1zeek

  C++

  •

  BSD 3-Clause "New" or "Revised" License

  •4•9•3•2•Updated Feb 12, 2025Feb 12, 2025

• terraform-azure-sensor

  Public
  Terraform for Corelight's Azure Cloud Sensor Deployment.

  cloudazureterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •0•2•0•0•Updated Feb 6, 2025Feb 6, 2025

• zeek-caldera-detector

  Public
  A Zeek based Mitre Caldera detector.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •0•0•0•0•Updated Feb 6, 2025Feb 6, 2025

• ecs-templates

  Public
  Corelight or Zeek Elastic Common Schema Templates

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •6•8•2•0•Updated Feb 5, 2025Feb 5, 2025

• ecs-logstash-mappings

  Public
  Mapping Corelight or Zeek data to Elastic Common Schema logs

  BSD 3-Clause "New" or "Revised" License

  •6•12•1•0•Updated Feb 5, 2025Feb 5, 2025

• ecs-mapping

  Public
  Mapping Corelight or Zeek data to Elastic Common Schema fields

  BSD 3-Clause "New" or "Revised" License

  •15•34•1•0•Updated Feb 5, 2025Feb 5, 2025

• zeek-long-connections

  Public
  Zeek package for tracking long connections to report them before they have completed.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •22•29•3•0•Updated Jan 30, 2025Jan 30, 2025

• zeek-spicy-wireguard

  Public
  A Zeek Wireguard protocol analyzer based on Spicy.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •3•6•0•0•Updated Jan 24, 2025Jan 24, 2025

• zeek-spicy-ipsec

  Public
  A Zeek IPSec protocol analyzer based on Spicy.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •7•8•0•0•Updated Jan 24, 2025Jan 24, 2025

• zeek-spicy-openvpn

  Public
  A Zeek OpenVPN protocol analyzer, based on Spicy.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •3•8•1•0•Updated Jan 24, 2025Jan 24, 2025

• block-corelight-chronicle

  Public
  Looker Dashboards for Chronicle

  LookML

  •

  MIT License

  •5•1•0•0•Updated Jan 15, 2025Jan 15, 2025

• go-zeek-broker-ws

  Public
  A Go library for using zeek broker's websocket API

  Go

  •

  BSD 3-Clause "New" or "Revised" License

  •0•5•2•0•Updated Jan 14, 2025Jan 14, 2025

• zeek-spicy-ospf

  Public
  A Zeek OSPF packet analyzer based on Spicy.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •3•8•0•0•Updated Jan 8, 2025Jan 8, 2025

• detect-ransomware-filenames

  Public
  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •10•16•0•0•Updated Dec 20, 2024Dec 20, 2024

• corelight-client

  Public
  Corelight Sensor API command-line client

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •5•17•3•2•Updated Nov 27, 2024Nov 27, 2024

• icannTLD

  Public
  Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The source of the ICANN TLD's can be found here: https://publicsuffix.org/list/effective_tld_names.dat. The Trusted Domains list is a custom list, created by the user…

  Zeek

  •

  Other

  •5•6•0•0•Updated Nov 14, 2024Nov 14, 2024

• ExtendIntel

  Public
  This package extends the Intel package to log more fields

  Zeek

  •

  Other

  •0•2•0•0•Updated Nov 11, 2024Nov 11, 2024

• Chronicle

  Public
  Chronicle parser for CORELIGHT and related information.

  Python

  •4•3•0•0•Updated Nov 8, 2024Nov 8, 2024

• Zeek-Endpoint-Enrichment

  Public
  Zeek

  •

  Other

  •1•2•0•1•Updated Nov 7, 2024Nov 7, 2024

• Zeek-Endpoint-Enrichment-conn

  Public
  Enrich the conn.log with EDR data

  Zeek

  •

  Other

  •0•1•0•0•Updated Nov 7, 2024Nov 7, 2024

• Zeek-Endpoint-Enrichment-all

  Public
  Zeek

  •

  Other

  •0•1•0•0•Updated Nov 7, 2024Nov 7, 2024

• terraform-gcp-enrichment

  Public
  Terraform for Corelight's GCP Cloud Enrichment.

  cloudenrichmentterraform+ 2gcpzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-gcp-sensor

  Public
  Terraform for Corelight's GCP Cloud Sensor Deployment.

  cloudterraformsensor+ 2gcpzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-azure-enrichment

  Public
  Terraform for Corelight's Azure Cloud Enrichment.

  cloudenrichmentazure+ 2terraformzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-aws-enrichment

  Public
  Terraform for Corelight's AWS Cloud Enrichment.

  awscloudenrichment+ 2terraformzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-aws-sensor

  Public
  Terraform for Corelight's AWS Cloud Sensor Deployment.

  awscloudterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• corelight-cloud

  Public
  IaC used to deploy Corelight Sensors into various Cloud Providers.

  awscloudazure+ 4terraformtemplatesgcpiac

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• cve-2022-22954

  Public
  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •2•1•0•0•Updated Oct 25, 2024Oct 25, 2024

• Zeek-CVE-Enrichment

  Public
  Zeek

  •2•1•0•0•Updated Oct 21, 2024Oct 21, 2024

• terraform-config-sensor

  Public
  Terraform for Corelight's Sensor Configuration.

  cloudterraformsensor+ 2configurationzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Oct 21, 2024Oct 21, 2024