Active Countermeasures's repositories
rita-legacy
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
threat-tools
Tools for simulating threats
docker-zeek
Run zeek with zeekctl in docker
pcap-stats
Learn about a network from a pcap file or reading from an interface
sniffer-template
Template for building a packet sniffer
certificate-issues
Identifies certificate problems from Zeek ssl log files
zeek-log-transport
This script ships logs from Zeek to AC-Hunter
safelist-tools
Tools for working with the safelist (formerly whitelist)
pcap-resources
Support files and tools for pcap analysis and packet capture
zeek-log-clean
Delete Zeek log files until disk usage is under a given threshold
bad-asn-list
An open source list of ASNs known to belong to cloud, managed hosting, and colo facilities.
save_json_stream
JSON TCP stream importer for RITA and AC-Hunter
tcp-sig-json
Json file that holds TCP signatures for passive OS fingerprinting
active-dns-lookup
Lookup hostnames via dns
get-release
Github Action to get release information based on a tag
zeek-agent-v2
Open source endpoint agent providing host information to Zeek. [v2]