Get Started

          Scripts + Resources

          Zeek / Bro packages / scripts

          Corelight Sensors come pre-loaded with a set of the most popular and useful Zeek / Bro packages (a Zeek package is a script with metadata), to get you up and running in minutes. But sometimes you want to add extra functionality or customization. These Zeek scripts have been vetted and tested for performance by the Corelight team.

          HTTP stalling detector script

          Detects HTTP stalling DoS attacks, such as Slowloris.

          Top DNS script

          Logs the top DNS requests at a configurable interval (15 min. default).

          JA3 script

          Generates SSL client fingerprints and logs them as a new field in the ssl.log.

          Unknown MIME type discovery script

          Logs files without known MIME types.

          Zeek logs

          Zeek logs: a selection

          Contains a selection of the most popular Zeeks / Bro logs, alphabetized and formatted for easy reference. Also includes key SMB logs for Microsoft® platforms.