Hi all. Sharing a small side-tool that plays well with Zeek workflows.
Sloth is a passive terminal monitor for Linux written in C99 with no third-party deps. It is not a Zeek replacement. It is a lightweight sensor you can run on a Pi or an embedded node where a full Zeek deploy is heavier than the site can carry. It emits JSONL for DNS, TLS (SNI + JA3), QUIC, HTTP, NTP, ICMP, and for every fired alert. It also captures EAPOL and PMKID in hashcat-22000 format for wireless work.
Would value a sanity check from this community on the JSONL schema and on the alert set: port scan, deauth flood, NXDOMAIN burst, threat-domain, threat-IP, beaconing. Happy to align field names with Zeek log conventions if that helps ingest.
Repo: GitHub - SpaceTrucker2196/sloth: Passive terminal network monitor for Linux · GitHub