{"id":22748038,"url":"https://github.com/githubfoam/zeek-sandbox","last_synced_at":"2025-03-30T05:42:33.807Z","repository":{"id":64275600,"uuid":"224610782","full_name":"githubfoam/zeek-sandbox","owner":"githubfoam","description":"zeek network security monitoring NIDS HIDS","archived":false,"fork":false,"pushed_at":"2020-10-17T22:13:09.000Z","size":70,"stargazers_count":2,"open_issues_count":2,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-05T07:49:41.023Z","etag":null,"topics":["cyber-threat-intelligence","digital-forensic-readiness","digital-forensics-incident-response","hids","host-based","intrusion-detection-system","network-based","network-security-monitoring","nids","pipeline","zeek"],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/githubfoam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-28T08:56:55.000Z","updated_at":"2024-03-21T15:07:18.000Z","dependencies_parsed_at":"2023-01-15T08:01:08.819Z","dependency_job_id":null,"html_url":"https://github.com/githubfoam/zeek-sandbox","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fzeek-sandbox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fzeek-sandbox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fzeek-sandbox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/githubfoam%2Fzeek-sandbox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/githubfoam","download_url":"https://codeload.github.com/githubfoam/zeek-sandbox/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246281216,"owners_count":20752207,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber-threat-intelligence","digital-forensic-readiness","digital-forensics-incident-response","hids","host-based","intrusion-detection-system","network-based","network-security-monitoring","nids","pipeline","zeek"],"created_at":"2024-12-11T03:19:14.327Z","updated_at":"2025-03-30T05:42:33.779Z","avatar_url":"https://github.com/githubfoam.png","language":"Ruby","readme":"# zeek sandbox\n\nTravis (.com) branch:\n[![Build Status](https://travis-ci.com/githubfoam/zeek-sandbox.svg?branch=master)](https://travis-ci.com/githubfoam/zeek-sandbox)  \n\n~~~~\nvagrant up\n\n$ export PATH=/opt/zeek/bin:$PATH\n~~~~\n~~~~\nwget https://www.malware-traffic-analysis.net/2018/CTF/2018-CTF-from-malware-traffic-analysis.net-1-of-2.pcap.zip\nhttps://www.malware-traffic-analysis.net/2018/CTF/index.htm\n\n$ unzip 2018-CTF-from-malware-traffic-analysis.net-2-of-2.pcap.zip\npassword:infected\nzeek -Cr 2018-CTF-from-malware-traffic-analysis.net-2-of-2.pcap\n\n[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut mac\n00:1e:67:4a:d7:5c\n00:1e:67:4a:d7:5c\n00:1e:67:4a:d7:5c\n[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut client_addr\n172.17.1.129\n172.17.1.129\n172.17.1.129\n\nQ1: What is the MAC address of the Windows client at 172.17.1.129?\n[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut mac client_addr | sort | uniq\n00:1e:67:4a:d7:5c       172.17.1.129\n\nQ2: What is the host name for the Windows client at 172.17.1.129?\n$ cat dhcp.log | zeek-cut client_addr host_name | sort | uniq\n172.17.1.129    Nalyvaiko-PC\n\n~~~~\n~~~~\n\"zeek-source\" role, platform independent building from git source\n\n\u003chttps://docs.zeek.org/en/stable/install/install.html#installing-from-source\u003e\n~~~~\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithubfoam%2Fzeek-sandbox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithubfoam%2Fzeek-sandbox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithubfoam%2Fzeek-sandbox/lists"}