RITA - An open source framework for network traffic analysis.

The framework ingests Zeek Logs in TSV or JSON format, and currently supports the following major features:

Beaconing Detection: 

Search for signs of beaconing behavior in and out of your network.

Long Connection Detection: Easily see connections that have communicated for long periods of time.

DNS Tunneling Detection: Search for signs of DNS based covert channels.

Threat Intel Feed Checking: Query threat intel feeds to search for suspicious domains and hosts.

Check out the Source at : Activecountermeasures