alkenepan/awesome-bro

Useful resources for Zeek(https://zeek.org/) (Bro(http://bro.org/))

awesome-bro(awesome-zeek)

WTF? Renaming the Bro Project? http://blog.bro.org/2018/10/renaming-bro-project_11.html

Zeek?

cancyber/cancyber_zeek

zeek/zeek-agent

salesforce/GQUIC_Protocol_Analyzer

@GTrunSec : Zeek resources collect

zeek/osquery-extension

tenzir/zeek-vast

emojifier/emojifier

J-Gras/intel-expire

J-Gras/bro-lognorm

michalpurzynski/bro-gramming

hosom/bro-ja3

hosom/bro-cron

DigiAngel/bro-protosigs

corelight/bro-long-connections

J-Gras/bro-fuzzy-hashing

iBigQ/osquery-plugin-bro

CrySyS/bro-step7-plugin

ncsa/bro-cluster-in-a-box-setup

ncsa/bro-simple-scan

hosom/bro-sandworm

bro/bro-plugins

JustinAzoff/bro-pdns

set-element/misc-scripts

bro/bro-netcontrol

hempnall/broyara

DigiAngel/bro-protosigs

fox-it/bro-scripts

LiamRandall/novaha-bro-training

bro/binpac

grigorescu/binpac_quickstart

reservoirlabs/bro-scripts

Kitware/bat

sooshie/bro-scripts

grigorescu/bro-scripts

bro/try-bro

grigorescu/Brownian

initconf/scan-NG

bro/package-manager

punkrokk/bro-lessons

CrowdStrike/cs-bro

JustinAzoff/bro_scripts

LiamRandall/BroMalware-Exercise

phirelight/bro-scripts

rsabir/bro-dsniff

antipatico/zeek-dronebl-dnsbl

awesome-bro's Issues

Building and Deploying Zeek with Sandbox

• Achievement proces：
  NixOS/nixpkgs#86494 (comment)

• the Zeek's Buiding ( same like flatpak https://github.com/flatpak/flatpak
  I don't know how to PR describes this PR clearly.

• Pass testing on NixOs Linux (debian ubuntu)
  -Debian https://github.com/hardenedlinux/debian-nix-manager#6-deploy-zeek-and-model
  （Zeek DevOps coming)

Jupyterlab for inforSec

• https://github.com/hardenedlinux/NSM-data-analysis

why is NSM-data-anaysis ? what is different with https://github.com/OTRF/infosec-jupyterthon

• for Security researcher https://github.com/GTrunSec/Jupyter-data-science-environment (torch or ML CUDA Support Now）
  I would like to use nix builds the Jupyter-lab or DFIR tools and services(like docker composer).
• manager easily and has embedded extensions for each part of the process.
• https://www.tweag.io/posts/2020-05-25-flakes.html ( next month, I will focus on the feature of flakes to build an environment with Zeek.
• Using flakes tracking and testing, updating with (hydra CI or github action). Instead of official https://github.com/zeek/packages. (and tool of zkg) https://github.com/hardenedlinux/debian-nix-manager/blob/master/pkgs/zeek/zeek-plugin.json

关于zeek/bro相关的插件和环境管理探讨

最近我做了在NIXOS下的整体NSM和hunting env. https://github.com/hardenedlinux/NSM-data-analysis
至于我为什么选择NIX包来管理，主要是方便和包括版本控制。
我增加了julia R Haskell python等安全分析的环境，为zeek 和silk等元数据sensor 服务。

我一段时间基于org-mode 倒是做了类似awesome-bro相关的东西https://www.gtrun.org/custom/NsmOrg.html

但目前感觉这个东西主要是涉及到基础面的东西太多。Osquery我目前来说就是把相关安全测试，给迁移到pet snippet.
你觉得类似项目，目前需要如何处理帮助他人。包括文档和插件的编写？