RITA - An open source framework for network traffic analysis.
- Talfor
- Oct 30
- 1 min read
The framework ingests Zeek Logs in TSV or JSON format, and currently supports the following major features:
Beaconing Detection:
Search for signs of beaconing behavior in and out of your network.
Long Connection Detection: Easily see connections that have communicated for long periods of time.
DNS Tunneling Detection: Search for signs of DNS based covert channels.
Threat Intel Feed Checking: Query threat intel feeds to search for suspicious domains and hosts.
Check out the Source at : Activecountermeasures
