Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Network recon framework.

Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, and Spark

An All-In-One home intrusion detection system (IDS) solution for the Raspberry PI.

Bro IDS Dockerfile

The default package source of the Zeek Package Manager

Extract files from network traffic with Zeek.

Bro IDS + ELK Stack to detect and block data exfiltration

Zeek's Messaging Library

Flow-Indexer indexes flows found in chunked log files from bro,nfdump,syslog, or pcap files

A list of your various social statii.

A package manager for Zeek

brostash: Linux distribution based on Debian and focusing on network security events collection

An extremely crude, lightweight Web Frontend for Suricata/Bro to be used with BriarIDS

Integrate Zeek with Alienvault OTX

Flexible framework that allows automation to process cyber threat information and update endpoint defense tools.

Zeek ( formerly Bro) Network Security Monitor package for pfSense router/firewall

Useful resources for Zeek(https://zeek.org/) (Bro(http://bro.org/))

Documentation for Zeek

BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to capture and index BRO/Zeek logs coming from a remote sensor.

Materials for the BSides NoVA/Charleston 2018 Bro Workshop

Plugin providing AF_XDP support for Bro.

Detect weird services on a network.

BILA: BRO IDS Logs Analyzer

Collect and parse Bro logs with Logstash+Filebeat

A saltstack formula to install BRO network security monitor on RHEL or Debian based systems

A Zeek Network Security Monitor Tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.

💡 Enhance Zeek with MAC address ages

Docker based Zeek IDS worker cluster

Enables Zeek to communicate with VAST