Zeek
Profiling Whonix
I downloaded Whonix version 15, in which two virtual machines work together to detect activity in a clever way.
Featured
Recognizing and detecting data exfiltration
See how to detect data exfiltration hiding in trusted protocols like DNS, SMB, and HTTP/S, and how Corelight catches it before it becomes a breach.