{"id":40943255,"url":"https://github.com/stratosphereips/zeek-summarizer","last_synced_at":"2026-01-22T04:37:27.556Z","repository":{"id":297501110,"uuid":"997001352","full_name":"stratosphereips/zeek-summarizer","owner":"stratosphereips","description":"Zeek Summarizer is a command-line tool to analyze and summarize Zeek log files","archived":false,"fork":false,"pushed_at":"2025-11-03T08:15:31.000Z","size":63,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-03T10:10:32.106Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stratosphereips.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-06-05T19:45:45.000Z","updated_at":"2025-11-03T08:15:20.000Z","dependencies_parsed_at":"2025-09-05T07:34:34.716Z","dependency_job_id":"cf533b34-2ce4-4498-9fde-bb50bb33af58","html_url":"https://github.com/stratosphereips/zeek-summarizer","commit_stats":null,"previous_names":["stratosphereips/zeek-summarizing","stratosphereips/zeek-summarizer"],"tags_count":13,"template":false,"template_full_name":"stratosphereips/awesome-code-template","purl":"pkg:github/stratosphereips/zeek-summarizer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2Fzeek-summarizer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2Fzeek-summarizer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2Fzeek-summarizer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2Fzeek-summarizer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stratosphereips","download_url":"https://codeload.github.com/stratosphereips/zeek-summarizer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stratosphereips%2Fzeek-summarizer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28654881,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-22T01:17:37.254Z","status":"online","status_checked_at":"2026-01-22T02:00:07.137Z","response_time":144,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-22T04:37:26.894Z","updated_at":"2026-01-22T04:37:27.549Z","avatar_url":"https://github.com/stratosphereips.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Zeek Summarizer\n\n`zeek-summarizer` digests a full Zeek log directory (plain TSV or JSON, compressed or not) and produces:\n\n- Global statistics for connections, DNS, HTTP, TLS/SSL, SMB, and SMTP activity.\n- Rich per-host drill downs (protocol mix, ports, DNS/HTTP targets, TLS issuers, SMB shares, SMTP senders/recipients, etc.).\n- Optional per-port view to see which services are most active or targeted.\n- Export to JSON or a self-contained HTML dashboard with interactive charts, search, and filters.\n\n## Web Dashboard\n\u003cimg width=\"1366\" height=\"697\" alt=\"image\" src=\"https://github.com/user-attachments/assets/df3537b6-e180-49cf-9716-eb149da4c816\" /\u003e\n\n## Text output\n\u003cimg width=\"1105\" height=\"475\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ac36cd3b-b174-44d2-ba6b-422d9bf2d65c\" /\u003e\n\n\n---\n\n## 1. Requirements\n\n- Python 3.10+ (tested with 3.11/3.12/3.13)\n- Zeek logs on disk (e.g. `conn.log`, `dns.log`, `http.log`, `ssl.log`, `smtp.log`)\n- Packages listed in `requirements.txt`\n\n---\n\n## 2. Installation\n\n```bash\n# Clone the repository\ngit clone https://github.com/stratosphereips/zeek-summarizer.git\ncd zeek-summarizer\n\n# Create and activate a virtual environment\npython3 -m venv venv\nsource venv/bin/activate\n\n# Install dependencies\npip install --upgrade pip\npip install -r requirements.txt\n```\n\nTo leave the environment later, run `deactivate`.\n\n---\n\n## 3. Quick Start (text summary)\n\n```bash\n./zeek-summarizer.sh -d /path/to/zeek/logs\n# or python venv/bin/python zeek-summarizer.py -d /path/to/zeek/logs\n```\n\nUseful CLI flags:\n\n| Flag | Description |\n| --- | --- |\n| `-d DIR` | Directory containing Zeek logs (supports rotated `*.log*` and `*.log.gz`). |\n| `-r`, `--require-activity` | Only list hosts that appear in non-`conn` logs. |\n| `-o`, `--only-conn` | Only list hosts that have `conn` activity and nothing else. |\n| `-p`, `--per-port` | Switch to per-port aggregated view. |\n| `--local-only` | Keep statistics for private/local IPs only (v4/v6). |\n| `--output-format {text,json,html}` | Choose output renderer (default `text`). |\n| `--output-file PATH` | Write JSON/HTML to file instead of STDOUT (ignored for `text`). |\n\nThe helper script `zeek-summarizer.sh` simply activates the bundled `venv/` and forwards every argument to the Python entry point (`\"$@\"`).\n\n---\n\n## 4. Generate the interactive dashboard\n\n```bash\n./zeek-summarizer.sh -d /path/to/zeek/logs \\\n  --output-format html \\\n  --output-file zeek-dashboard.html\n\n# Open the report locally (macOS example)\nopen zeek-dashboard.html\n```\n\nThe HTML uses embedded data: no web server or backend required. Charts cover protocol mix, top DNS/HTTP targets, port targeting, SMTP TLS usage, and SMTP error codes. The search bar and filters let you jump straight to local hosts, specific /24 or /64 networks, or hosts that triggered non-connection logs.\n\n---\n\n## 5. Export machine-readable JSON\n\n```bash\n./zeek-summarizer.sh -d /path/to/zeek/logs \\\n  --output-format json \\\n  --output-file zeek-summary.json\n```\n\nEach host entry includes counters for protocols, flows, DNS queries, HTTP hosts, TLS issuers/subjects, SMB shares, SMTP metadata, and port usage. The `global` section mirrors the top cards in the dashboard.\n\n---\n\n## 6. Example workflows\n\n```bash\n# Baseline summary (text)\n./zeek-summarizer.sh -d ./sample-logs\n\n# Focus on local assets that touched non-connection logs\n./zeek-summarizer.sh -d ./sample-logs -r --local-only\n\n# Investigate service exposure (per-port view)\n./zeek-summarizer.sh -d ./sample-logs -p\n\n# Produce HTML and JSON in one go\n./zeek-summarizer.sh -d ./sample-logs --output-format html --output-file report.html\n./zeek-summarizer.sh -d ./sample-logs --output-format json --output-file report.json\n```\n\n---\n\n## 7. Supported log families\n\n- `conn.log`\n- `dns.log`\n- `http.log`\n- `ssl.log`\n- `smb_mapping.log`\n- `smtp.log`\n\nThe parser accepts TSV (default Zeek format) and JSON, with optional `.gz` compression and rotated filenames such as `dns.2024-10-05-00-00-00.log.gz`.\n\n---\n\nMade with ❤️ for network defenders who want fast situational awareness from Zeek captures.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstratosphereips%2Fzeek-summarizer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstratosphereips%2Fzeek-summarizer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstratosphereips%2Fzeek-summarizer/lists"}