Zeek
UnverifiedREPOsolomonneas/zeek-mcp
D
Catalogue entry updated 4 days ago
Auth postureNot probedno remote endpoint probed yet
Tools392 Execute · 3 Write · 34 Read
Worst categoryExecutegrade tracks the peak, not the average
Capability mix
Execute 2Write 3Read 34
What it can reach
Ingests untrusted inputTouches secretsReaches networkRuns codeTouches filesChanges permissionsSends external commsPersistsDeletes dataMoves money
Tools 39
pcap_analyzezeek_detect_anomaliesmisp_add_eventthehive_create_alertthehive_create_case
View all 39 tools
misp_bulk_lookupmisp_search_iocsnids_sensor_statuspcap_listsuricata_alert_summarysuricata_correlate_zeeksuricata_eve_statssuricata_query_alertsthehive_search_caseszeek_connection_summaryzeek_detect_beaconingzeek_detect_outlierszeek_dhcp_asset_mapzeek_dns_summaryzeek_dns_tunneling_checkzeek_executable_downloadszeek_expired_certszeek_investigate_hostzeek_investigate_uidzeek_ja3_fingerprintszeek_ja3_huntzeek_long_connectionszeek_network_baselinezeek_query_connectionszeek_query_dhcpzeek_query_dnszeek_query_fileszeek_query_httpzeek_query_noticeszeek_query_sshzeek_query_sslzeek_software_inventoryzeek_ssh_bruteforcezeek_suspicious_http
Change history
No changes recorded since first scan. Watched servers surface a diff within the hour.
Recommended policy
pcap_analyzerequire approval
misp_add_eventrate limit
Read-only toolsallow
Full policy breakdown with enforcement rules →