zkg.meta

[package]
description =  A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs. 
tags = zeek scripting, dns, domain, notices
script_dir = scripts
depends = 
    zeek >=5.0.8
    https://github.com/sethhall/domain-tld >=1.2.2

config_files = domain-whitelist.zeek, fast_flux-whitelist.zeek, recursive-whitelist.zeek, scripts/__load__.zeek, scripts/domain-whitelist.zeek, scripts/fast_flux-whitelist.zeek, scripts/recursive-whitelist.zeek