Active Countermeasures

rita-legacy

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

BeaKer

Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana

passer

Passive service locator, a python sniffer that identifies servers, clients, names and much more

threat-tools

Tools for simulating threats

rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

espy

Endpoint detection for remote hosts for consumption by RITA and Elasticsearch

docker-zeek

Run zeek with zeekctl in docker

smudge

Passive OS detection based on SYN packets without Transmitting any Data

pcap-stats

Learn about a network from a pcap file or reading from an interface

zcutter

Extracts fields from zeek logs, compatible with zeek-cut

sniffer-template

Template for building a packet sniffer

zeek-open-connections

rita-bl

Real Intelligence Threat Analytics -- Blacklist Database

zeekcfg

A node.cfg generator for zeekctl

certificate-issues

Identifies certificate problems from Zeek ssl log files

shell-lib

Shell Scripts Used Across ActiveCM Projects

zeek-log-transport

This script ships logs from Zeek to AC-Hunter

mgosec

A Small Helper Library For Securing MongoDB Connections with Golang

safelist-tools

Tools for working with the safelist (formerly whitelist)

pcap-resources

Support files and tools for pcap analysis and packet capture

zeek-log-clean

Delete Zeek log files until disk usage is under a given threshold

bad-asn-list

An open source list of ASNs known to belong to cloud, managed hosting, and colo facilities.

save_json_stream

JSON TCP stream importer for RITA and AC-Hunter

tcp-sig-json

Json file that holds TCP signatures for passive OS fingerprinting

ACH-Zeek

Zeek installer packaged with AC-Hunter

active-dns-lookup

Lookup hostnames via dns

db-lib

Python database access library

get-release

Github Action to get release information based on a tag

packages

The default package source of the Zeek Package Manager

zeek-agent-v2

Open source endpoint agent providing host information to Zeek. [v2]