Zeek Python Packages

tenzir

Tenzir is the data pipeline engine for security teams.

pyvast

Tenzir is the data pipeline engine for security teams.

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

pcaptriage

Automated pcap triage on top of Zeek: MITRE ATT&CK-mapped findings and an HTML report, in one command.

sigwood

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

threatbus

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

ivre

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

zat

Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, Kafka and Spark

bat

Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, Kafka and Spark

threatbus-zeek

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

dynamite-nsm

DynamiteNSM is a free Network Security Monitor to enable network visibility and advanced cyber threat detection

threatbus-inmem

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

threatbus-misp

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

threatbus-cif3

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

threatbus-rabbitmq

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

parsezeeklogs

Read Zeek (Bro) logs into typed Python records; convert to JSON or CSV, map to Elastic Common Schema, load into Elasticsearch.

autozeekwatch

An online, deployable machine learning network intrusion detection system for Zeek.

pytenzir

Tenzir is the data pipeline engine for security teams.

pyvast-threatbus

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

suricata-threatbus

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

threatbus-zmq-app

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

stix-shifter-threatbus

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

threatbus-zmq

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

vast-threatbus

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.