Process-aware, eBPF-based tcpdump

Custom artifacts for Velociraptor DFIR

Language server for Zeek script

The default package source of the Zeek Package Manager. Wrote a package? See the README for how to get it included.

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Dictionary based map filter for Fluentd

Transform Linux Audit logs for SIEM usage

Live forensic artifacts collector

A framework for Backdoor development!