Repositories list

• ExtendIntel

  Public
  This package extends the Intel package to log more fields

  Zeek

  •

  Other

  •0•1•0•0•Updated Nov 11, 2024Nov 11, 2024

• Chronicle

  Public
  Chronicle parser for CORELIGHT and related information.

  Python

  •4•3•0•0•Updated Nov 8, 2024Nov 8, 2024

• Zeek-Endpoint-Enrichment

  Public
  Zeek

  •

  Other

  •1•2•0•1•Updated Nov 7, 2024Nov 7, 2024

• Zeek-Endpoint-Enrichment-conn

  Public
  Enrich the conn.log with EDR data

  Zeek

  •

  Other

  •0•1•0•0•Updated Nov 7, 2024Nov 7, 2024

• Zeek-Endpoint-Enrichment-all

  Public
  Zeek

  •

  Other

  •0•1•0•0•Updated Nov 7, 2024Nov 7, 2024

• icannTLD

  Public
  Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The source of the ICANN TLD's can be found here: https://publicsuffix.org/list/effective_tld_names.dat. The Trusted Domains list is a custom list, created by the user…

  Zeek

  •

  Other

  •5•5•0•0•Updated Nov 7, 2024Nov 7, 2024

• terraform-gcp-enrichment

  Public
  Terraform for Corelight's GCP Cloud Enrichment.

  cloudenrichmentterraform+ 2gcpzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-gcp-sensor

  Public
  Terraform for Corelight's GCP Cloud Sensor Deployment.

  cloudterraformsensor+ 2gcpzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-azure-enrichment

  Public
  Terraform for Corelight's Azure Cloud Enrichment.

  cloudenrichmentazure+ 2terraformzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-azure-sensor

  Public
  Terraform for Corelight's Azure Cloud Sensor Deployment.

  cloudazureterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-aws-enrichment

  Public
  Terraform for Corelight's AWS Cloud Enrichment.

  awscloudenrichment+ 2terraformzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• terraform-aws-sensor

  Public
  Terraform for Corelight's AWS Cloud Sensor Deployment.

  awscloudterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• corelight-cloud

  Public
  IaC used to deploy Corelight Sensors into various Cloud Providers.

  awscloudazure+ 4terraformtemplatesgcpiac

  HCL

  •

  MIT License

  •0•1•0•0•Updated Nov 6, 2024Nov 6, 2024

• ecs-templates

  Public
  Corelight or Zeek Elastic Common Schema Templates

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •6•8•2•0•Updated Nov 6, 2024Nov 6, 2024

• ecs-mapping

  Public
  Mapping Corelight or Zeek data to Elastic Common Schema fields

  BSD 3-Clause "New" or "Revised" License

  •15•34•1•0•Updated Nov 5, 2024Nov 5, 2024

• ecs-logstash-mappings

  Public
  Mapping Corelight or Zeek data to Elastic Common Schema logs

  BSD 3-Clause "New" or "Revised" License

  •6•12•1•0•Updated Oct 29, 2024Oct 29, 2024

• go-zeek-broker-ws

  Public
  A Go library for using zeek broker's websocket API

  Go

  •

  BSD 3-Clause "New" or "Revised" License

  •0•4•2•0•Updated Oct 25, 2024Oct 25, 2024

• cve-2022-22954

  Public
  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •2•1•0•0•Updated Oct 25, 2024Oct 25, 2024

• zeekjs

  Public
  ZeekJS - Experimental JavaScript support for Zeek.

  nodejsjavascriptv8+ 1zeek

  C++

  •

  BSD 3-Clause "New" or "Revised" License

  •4•9•2•1•Updated Oct 23, 2024Oct 23, 2024

• Zeek-CVE-Enrichment

  Public
  Zeek

  •2•1•0•0•Updated Oct 21, 2024Oct 21, 2024

• terraform-config-sensor

  Public
  Terraform for Corelight's Sensor Configuration.

  cloudterraformsensor+ 2configurationzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Oct 21, 2024Oct 21, 2024

• CVE-2021-31166

  Public
  HTTP Protocol Stack CVE-2021-31166

  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •6•13•0•0•Updated Oct 17, 2024Oct 17, 2024

• zeek-netsupport-detector

  Public
  A Zeek base NetSupport detector. NetSupport is often abused by attackers in malware.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •1•1•0•0•Updated Oct 16, 2024Oct 16, 2024

• CVE-2022-26937

  Public
  A Zeek package to detect CVE-2022-26937, a vulnerability in the Network Lock Manager (NLM) protocol in Windows NFS server.

  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •3•6•0•0•Updated Oct 15, 2024Oct 15, 2024

• cve-2022-21907

  Public
  cve-2022-21907

  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •1•5•0•0•Updated Oct 14, 2024Oct 14, 2024

• Elasticsearch_rules

  Public
  Elastic version of SOC prime watcher rules

  BSD 3-Clause "New" or "Revised" License

  •6•28•0•0•Updated Oct 14, 2024Oct 14, 2024

• zeek-quasarrat-detector

  Public
  Zeek detector for QuasarRat

  Shell

  •

  BSD 3-Clause "New" or "Revised" License

  •0•0•0•0•Updated Oct 9, 2024Oct 9, 2024

• suricata_exporter

  Public
  A Prometheus Exporter for Suricata

  prometheusprometheus-exportersuricata

  Go

  •

  BSD 3-Clause "New" or "Revised" License

  •11•19•1•0•Updated Oct 8, 2024Oct 8, 2024

• community-id-spec

  Public
  An open standard for hashing network flows into identifiers, a.k.a "Community IDs".

  network-monitoringnetwork-security-monitoringnetwork-security+ 3flow-hashingcommunity-idnetwork-flow

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •25•171•12•0•Updated Sep 23, 2024Sep 23, 2024

• cve-2022-26809

  Public
  Detects attempts and successful exploitation of CVE-2022-26809

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •15•32•0•0•Updated Sep 16, 2024Sep 16, 2024