https://github.com/stratosphereips/zeek-term
A python tool to see ordered zeek log files with colors in the terminal, like termshark.
https://github.com/stratosphereips/zeek-term
Last synced: 6 months ago
JSON representation
A python tool to see ordered zeek log files with colors in the terminal, like termshark.
- Host: GitHub
- URL: https://github.com/stratosphereips/zeek-term
- Owner: stratosphereips
- License: gpl-2.0
- Created: 2024-07-24T20:29:05.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2025-08-05T18:15:03.000Z (12 months ago)
- Last Synced: 2025-09-05T02:28:54.418Z (11 months ago)
- Language: Python
- Size: 38.1 KB
- Stars: 1
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: .github/CONTRIBUTING.md
- License: LICENSE
- Code of conduct: .github/CODE_OF_CONDUCT.md
- Citation: CITATION.cff
- Security: .github/SECURITY.md
Awesome Lists containing this project
README
# Zeek-term
Zeek-term is a python program that reads several Zeek log files (conn.log, http.log, files.log, ssl.log, quick.log, dns.log, ntp.log) and prints all the lines sorted by time. It also adds colors so it is easier to analyze.
## Features
- Sorted logs from all the Zeek files.
- Adds background color.
- Adds foreground color.
- Adds a column with the name of the file that each log cames from.
## Usage
```python
python zeek-term.py --foreground --directory . |less -RS
```
- `--foreground` is to use foreground colors instead of background
- `--directory` is to set where the Zeek logs are
- `--filter-conn` is to filter all the conn.log lines which UID is in other Zeek file. Therefore, if a flow produced other log appart from the conn.log, then the conn.log one is ignored. This is good if you want to know which conn.log lines do not have a recognizable protocol and are interesting to see.
# How it looks like
With --filter-conn
Without --foreground
# About
This tool was developed at the Stratosphere Laboratory at the Czech Technical University in Prague by Sebastian Garcia, sebastian.garcia@agents.fel.cvut.cz