# Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE **URL:** \ **Category:** Zeek\ **Created:** [March 27, 2019, 1:02pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647 "2019-03-27T13:02:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Fernandez\_Mark\_I](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Fernandez\_Mark\_I](https://community.zeek.org/u/Fernandez_Mark_I)\ **Post date:** [March 27, 2019, 1:02pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/1 "2019-03-27T13:02:08Z")
All, MITRE has created a set of Bro/Zeek scripts to detect ATT&CK-like adversarial activity. The project is called BZAR – Bro/Zeek ATT&CK-based Analytics and Reporting. MITRE ATT&CK is a publicly-available, curated knowledge base for cyber adversary behavior, reflecting the various phases of the adversary lifecycle and the platforms they are known to target. The ATT&CK model includes behaviors of numerous threats groups. BZAR is a set of Bro/Zeek scripts utilizing the SMB and DCE-RPC protocol analyzers and the File Extraction Framework to detect ATT&CK-like activity, correlate certain techniques, and write to the Notice Log. BZAR is publicly released as open source, under MITRE case number 18-2489. It is available for download at the following URL: - [https://github.com/mitre-attack/car/tree/master/implementations/bzar](https://github.com/mitre-attack/car/tree/master/implementations/bzar) For more information on MITRE ATT&CK, visit [https://attack.mitre.org](https://attack.mitre.org). **Mark I. Fernandez** The MITRE Corporation [mfernandez@mitre.org](mailto:mfernandez@mitre.org) P.S. It does not yet support the Bro/Zeek Package Manager (this is on the todo list). ---
**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\ **Post date:** [March 27, 2019, 1:37pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/2 "2019-03-27T13:37:04Z")
Nice work, thanks for sharing! ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [March 27, 2019, 2:44pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/3 "2019-03-27T14:44:46Z")
Seconded! This is great, thanks for sharing Mark! Are guys planning on turning this into a package and adding it to the package manager? [https://bro-package-manager.readthedocs.io/en/stable/package.html](https://bro-package-manager.readthedocs.io/en/stable/package.html)    .Seth ---
**Author:** ![Fernandez\_Mark\_I](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Fernandez\_Mark\_I](https://community.zeek.org/u/Fernandez_Mark_I)\ **Post date:** [March 27, 2019, 2:48pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/4 "2019-03-27T14:48:52Z")
Hi Seth, yes, that is on the todo list. Hopefully, I'll have a package for it and add it to the package-manager soon. Mark ---
**Author:** ![Amber\_Graner](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@Amber\_Graner](https://community.zeek.org/u/Amber_Graner)\ **Post date:** [March 27, 2019, 3:14pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/5 "2019-03-27T15:14:19Z")
Mark, Thank you so much for sharing this. ~Amber ---
**Author:** ![Weasel\_Gary\_W\_CIV\_DI](https://avatars.discourse-cdn.com/v4/letter/w/c77e96/32.png) [@Weasel\_Gary\_W\_CIV\_DI](https://community.zeek.org/u/Weasel_Gary_W_CIV_DI)\ **Post date:** [March 27, 2019, 6:35pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/6 "2019-03-27T18:35:36Z")
Mark, Is this developed for Bro/Zeek 2.5.5? I'm getting errors when attempting to load this in Bro/Zeek 2.6.1. v/r Gary W. Weasel, Jr. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5647/7 "2022-05-06T15:46:24Z")
Closed on May 6, 2022, 3:46pm UTC