rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

rita

RITA（リアルインテリジェンス脅威分析） RITAの価値を感じ、さらに自動ハンティング、未来志向の可視化、データエンリッチメントを進めたい場合は、AC-Hunterをご覧ください。 Active Countermeasures 提供。 BHIS スポンサー。 RITAは、ネットワークトラフィック分析のためのオープンソースフレームワークです。 このフレームワークは、TSVまたはJSON形式のZeekログを取り込み、現在以下の主要機能をサポートしています： ビーコン検出 : ネットワーク内外のビーコン動作の兆候を検索 長時間接続検出 : 長時間通信している接続を簡単に確認...

Malcolm

Malcolm Malcolm은 강력한 네트워크 트래픽 분석 도구 모음으로, 다음 목표를 염두에 두고 설계되었습니다: 사용하기 쉬움 – Malcolm은 전체 패킷 캡처PCAP 파일, Zeek 로그, Suricata 알림 형태의 네트워크 트래픽 데이터를 수용합니다. 이러한 아티팩트는 간단한 브라우저 기반 인터페이스를 통해 업로드하거나, 경량 포워더를 사용하여 수동적으로 캡처하여 Malcolm으로 전달할 수 있습니다. 두 경우 모두 데이터는 자동으로 정규화, 강화, 상관 관계 분석됩니다. 강력한 트래픽 분석 – 네트워크 통신에 대한...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment 호스트 정보로 Zeek 로그를 보강합니다 id 필드가 있는 모든 로그를 보강하려면 ".-all" 태그를 사용하세요. id 필드가 있는 모든 로그와 Known Entities를 보강하려면 ".-known-all" 태그를 사용하세요. conn.log만 보강하려면 ".-conn" 태그를 사용하세요. conn.log와 Known Entities만 보강하려면 ".-known-conn" 태그를 사용하세요. 자세한 문서는 https://docs.corelight.com 을 참조하세요...

Malcolm v26.08.0

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

Malcolm v26.08.0

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

Malcolm v26.07.1

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

PHASE: Passive Human Activity Simulation Evaluation

Cybersecurity simulation environments, such as cyber ranges, honeypots, and sandboxes, require realistic human behavior to be effective, yet no quantitative method exists to assess the behavioral fidelity of synthetic user personas. This paper presents PHASE Passive Human Activity Simulation...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

SnapAttack Log4j / CVE-2021-44228 / log4shell Resources Wh...

One Weird Trick for Reviewing Zeek Logs on the Command Line!

Are you a network security monitoring dinosaur like me? Do you prefer to inspect your Zeek logs using the command line instead of a Web-based SIEM? If yes, try this one weird trick! I store my Zeek logs in JSON format. Sometimes I like to view the output using jq. If I need to search directories ...