Repositories list

• zeek-log-writer-nats

  Public
  A Zeek log writer implementation for the NATS.io Connective Technology JetStream persistence system.

  securityloggingnats+ 3zeeknats-jetstreamzeek-plugin

  C++

  •

  BSD 3-Clause "New" or "Revised" License

  •0•1•0•0•Updated Feb 19, 2026Feb 19, 2026

• zeek-spicy-wireguard

  Public
  A Zeek Wireguard protocol analyzer based on Spicy.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •4•7•0•1•Updated Feb 10, 2026Feb 10, 2026

• CorelightForSecOps

  Public
  Chronicle parser for CORELIGHT and related information.

  Python

  •4•5•0•0•Updated Feb 9, 2026Feb 9, 2026

• corelight-cloud

  Public
  IaC used to deploy Corelight Sensors into various Cloud Providers.

  awscloudazure+ 4terraformtemplatesgcpiac

  HCL

  •

  MIT License

  •2•2•0•1•Updated Feb 3, 2026Feb 3, 2026

• terraform-azure-sensor

  Public
  Terraform for Corelight's Azure Cloud Sensor Deployment.

  cloudazureterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •2•2•1•1•Updated Jan 30, 2026Jan 30, 2026

• terraform-aws-sensor

  Public
  Terraform for Corelight's AWS Cloud Sensor Deployment.

  awscloudterraform+ 2sensorzeek

  HCL

  •

  MIT License

  •5•3•0•0•Updated Jan 30, 2026Jan 30, 2026

• shared-actions

  Public
  Centralized location for github actions to reuse across repos.

  terraformactions

  0•0•0•0•Updated Jan 30, 2026Jan 30, 2026

• zeekjs

  Public
  ZeekJS - Experimental JavaScript support for Zeek.

  nodejsjavascriptv8+ 1zeek

  C++

  •

  BSD 3-Clause "New" or "Revised" License

  •7•8•2•1•Updated Jan 26, 2026Jan 26, 2026

• terraform-gcp-sensor

  Public
  Terraform for Corelight's GCP Cloud Sensor Deployment.

  cloudterraformsensor+ 2gcpzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Jan 12, 2026Jan 12, 2026

• zeek-mercury-npf

  Public
  Zeek

  •

  Other

  •0•0•0•0•Updated Jan 11, 2026Jan 11, 2026

• corelight-client

  Public
  Corelight Sensor API command-line client

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •5•17•2•1•Updated Jan 9, 2026Jan 9, 2026

• CorelightForSentinelOne

  Public
  Corelight Dashboards and Parsers for Sentinel One Singularity

  0•3•0•0•Updated Dec 29, 2025Dec 29, 2025

• ecs-dashboards

  Public
  4•9•2•0•Updated Dec 22, 2025Dec 22, 2025

• ecs-templates

  Public
  Corelight or Zeek Elastic Common Schema Templates

  Python

  •

  BSD 3-Clause "New" or "Revised" License

  •6•9•2•0•Updated Dec 22, 2025Dec 22, 2025

• ecs-logstash-mappings

  Public
  Mapping Corelight or Zeek data to Elastic Common Schema logs

  BSD 3-Clause "New" or "Revised" License

  •6•12•2•0•Updated Dec 21, 2025Dec 21, 2025

• terraform-aws-single-sensor

  Public
  Terraform for a single AWS Corelight EC2 instance Cloud Sensor Deployment.

  awscloudterraform+ 1iac

  HCL

  •

  MIT License

  •0•1•0•0•Updated Dec 17, 2025Dec 17, 2025

• terraform-aws-enrichment

  Public
  Terraform for Corelight's AWS Cloud Enrichment.

  awscloudenrichment+ 2terraformzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Dec 17, 2025Dec 17, 2025

• terraform-config-sensor

  Public
  Terraform for Corelight's Sensor Configuration.

  cloudterraformsensor+ 2configurationzeek

  HCL

  •

  MIT License

  •0•1•0•0•Updated Dec 17, 2025Dec 17, 2025

• log-add-http-post-bodies

  Public
  Add POST body excerpt to Bro's HTTP log

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •11•14•0•1•Updated Dec 10, 2025Dec 10, 2025

• json-streaming-logs

  Public
  Zeek package to create JSON formatted logs to stream into data analysis systems.

  Zeek

  •

  BSD 2-Clause "Simplified" License

  •11•30•2•0•Updated Dec 3, 2025Dec 3, 2025

• CorelightForCrowdStrike

  Public
  Corelight app for CrowdStrike LogScale and Next-Gen SIEM

  0•4•0•0•Updated Nov 27, 2025Nov 27, 2025

• cve-2021-44228

  Public
  Log4j Exploit Detection Logic for Zeek

  zeekcve-2021-44228

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •9•19•10•1•Updated Nov 25, 2025Nov 25, 2025

• zeek-long-connections

  Public
  Zeek package for tracking long connections to report them before they have completed.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •23•31•3•0•Updated Nov 25, 2025Nov 25, 2025

• zeek-agenttesla-detector

  Public
  A Zeek based Agent Tesla malware C2 detector.

  Zeek

  •

  BSD 3-Clause "New" or "Revised" License

  •0•1•0•0•Updated Nov 25, 2025Nov 25, 2025

• ecs-mapping

  Public

  corelight/ecs-mapping’s past year of commit activity
  Mapping Corelight or Zeek data to Elastic Common Schema fields

  BSD 3-Clause "New" or "Revised" License

  •14•34•1•0•Updated Nov 3, 2025Nov 3, 2025

• terraform-aws-fleet

  Public
  Terraform for Corelight Fleet Deployment.

  awscloudterraform+ 2iacfleet

  HCL

  •

  MIT License

  •0•0•0•0•Updated Oct 31, 2025Oct 31, 2025

• terraform-config-fleet

  Public

  corelight/terraform-config-fleet’s past year of commit activity
  Terraform for Corelight's Fleet Manager Configuration.

  cloudterraformconfiguration+ 2fleetzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Oct 31, 2025Oct 31, 2025

• terraform-gcp-enrichment

  Public
  Terraform for Corelight's GCP Cloud Enrichment.

  cloudenrichmentterraform+ 2gcpzeek

  HCL

  •

  MIT License

  •2•0•2•0•Updated Oct 29, 2025Oct 29, 2025

• terraform-azure-enrichment

  Public
  Terraform for Corelight's Azure Cloud Enrichment.

  cloudenrichmentazure+ 2terraformzeek

  HCL

  •

  MIT License

  •0•0•0•0•Updated Oct 29, 2025Oct 29, 2025

• CorelightForMSSentinel

  Public
  MS Sentinel Dashboards, Parsers, and Documentation

  0•2•0•0•Updated Oct 21, 2025Oct 21, 2025