RITA

RITA, Real Intelligence Threat Analytics from Active Countermeasures, ingests Zeek logs and scores connections for beaconing, long connections, and DNS tunneling, and checks hosts against threat intel feeds. Beacon scores combine timestamp, data size, duration, and histogram subscores, and results are sorted into critical, high, medium, and low severity in a terminal UI or exported as CSV. It pairs with AC-Hunter, a separately licensed product from the same company. Zeek sensors feed logs to RITA, often through an hourly import on a cron job.

Finding command-and-control beaconing in Zeek telemetry without a commercial NDR platform.

• +Beacon scoring looks at communication over long timeframes, which catches C2 that simple signatures miss.
• +Free complement to a Zeek deployment.
• +Severity-sorted results with search filters and CSV export.

• +Batch analysis, not real-time detection.
• +Depends entirely on Zeek log quality and retention.

Detecting compromised hosts by their network timing and traffic patterns.