Active Countermeasures

Endpoint detection for remote hosts for consumption by RITA and Elasticsearch

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Run zeek with zeekctl in docker

Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana

This script ships logs from Zeek to AC-Hunter

Passive service locator, a python sniffer that identifies servers, clients, names and much more

Json file that holds TCP signatures for passive OS fingerprinting

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.