activecm/pcap-resources

Stars
2
Language
License
GNU General Publi...
Created over 2 years ago
Updated over 2 years ago

activecm/pcap-resources

activecm

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Support files and tools for pcap analysis and packet capture

rita-legacy

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

BeaKer

Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana

passer

Passive service locator, a python sniffer that identifies servers, clients, names and much more

threat-tools

Tools for simulating threats

rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

threat-hunting-labs

Collection of walkthroughs on various threat hunting techniques

espy

Endpoint detection for remote hosts for consumption by RITA and Elasticsearch

docker-zeek

Run zeek with zeekctl in docker

smudge

Passive OS detection based on SYN packets without Transmitting any Data

pcap-stats

Learn about a network from a pcap file or reading from an interface

bro-install

An Installation Script for Bro IDS on Debian Based Systems

zcutter

Extracts fields from zeek logs, compatible with zeek-cut

devprof

Device profile: Define acceptable amounts of traffic for your devices and see a report of outliers.

sniffer-template

Template for building a packet sniffer

zeek-open-connections

ipfix-rita

Collect IPFIX / Netflow v9 Records and Ship them to RITA for Analysis

rita-bl

Real Intelligence Threat Analytics -- Blacklist Database

mongo-diff

A Python script for diff'ing mongo databases

zeekcfg

A node.cfg generator for zeekctl

zeek-log-transport

This script ships logs from Zeek to AC-Hunter

pi_show

Python script/library for displaying text and graphics on Raspberry Pi PiOled Hat

shell-lib

Shell Scripts Used Across ActiveCM Projects

certificate-issues

Identifies certificate problems from Zeek ssl log files

pi_project_installer

A support library and set of scripts to simplify installing software on the Raspberry Pi/Raspbian

rita-blacklist

Real Intelligence Threat Analytics -- Blacklist Database

mgosec

A Small Helper Library For Securing MongoDB Connections with Golang

bro-rita

A bro plugin for writing log data to MongoDB for use with RITA

safelist-tools

Tools for working with the safelist (formerly whitelist)

docker-ca

A Docker Image For OpenSSL Certificate Authorities (For Testing)

zeek-log-clean

Delete Zeek log files until disk usage is under a given threshold

save_json_stream

JSON TCP stream importer for RITA and AC-Hunter

DBTest

Managed Integration Testing Dependencies via Docker for Go

bro-rita-test

Compares bro-rita against rita's built in parsing

bro-mongodb