A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!
The main features of corelight/zeek2es are: Security Logging and SIEM, Detection and Hunting Tools, Security Tools.
Open-source alternatives to corelight/zeek2es include: tenzir/vast — Tenzir is the data pipeline engine for security teams. security-onion-solutions/securityonion — Security Onion is a security information and event management platform and network security monitoring suite. It… blueteamlabs/sentinel-attack. brimsec/brim. certsocietegenerale/fir — Fast Incident Response. brexhq/substation — Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring. The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from dive
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
