activecm/rita-legacy

Health v2 · maintenance only

Adoption not part of the score

2509 stars · 352 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RITA (Real Intelligence Threat Analytics) is an open-source framework for detecting command and control communication through network traffic analysis. It ingests Zeek logs in TSV format and provides beaconing detection, DNS tunneling detection, and blacklist checking. This legacy repository is archived and unmaintained; the project has been rewritten at activecm/rita.

Use cases

• detect command and control beaconing in network traffic
• find DNS tunneling covert channels
• analyze Zeek logs for suspicious domains
• check hosts against threat blacklists
• hunt for malware beacon behavior on my network
• blue team network threat analytics

When to choose

• you need the original RITA feature set and cannot migrate
• you run an older environment (Ubuntu 20.04, CentOS 7, Security Onion) supported by its install script

When to avoid

• starting a new deployment - use the rewritten activecm/rita instead
• you need maintained software with ongoing support
• you need features beyond beaconing, DNS tunneling, and blacklist checks

Facets

framework · maturity abandoned

analytics monitoring security search-engine security networking analytics developer-tools go cli network-traffic-analysis zeek-logs beaconing-detection dns-tunneling threat-hunting blue-team mongodb legacy-archived linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="activecm/rita-legacy")