The Assessment module of Zeek has two things that equally work on signature detection and anomaly analysis. The initial of those analysis applications would be the Zeek occasion motor. This tracks for triggering gatherings, like a new TCP connection or an HTTP ask for. It's not