Flowtriq in the open source ecosystem:
Zeek, Agones, and community indexes

Back to Blog

Zeek Package Index

The zeek-flowtriq package was accepted into the official Zeek package index on June 26, 2026. You can now install it with a single command:

zkg install zeek-flowtriq

The package detects volumetric DDoS attacks (SYN floods, UDP floods, ICMP floods) using Zeek's traffic analysis framework and sends structured JSON alerts to your Flowtriq instance via webhook. It is pure Zeek scripts with no native plugins or build step required. Zeek 5.0+ is the only dependency.

For security teams already running Zeek for network security monitoring, this adds DDoS detection capability without deploying a separate sensor. Zeek sees the same traffic it is already inspecting for intrusion detection, protocol analysis, and file extraction. The Flowtriq package adds volumetric anomaly detection on top of that existing visibility.

How It Works

The package maintains per-destination traffic counters and detects anomalies based on rate thresholds. When a flood is detected, it generates a structured alert containing the target IP, attack type, peak packet rate, and timestamp. The alert is POSTed to your configured Flowtriq webhook URL, where it enters the standard detection and escalation pipeline.

Because this runs inside Zeek, the detection benefits from Zeek's protocol analysis. The package can distinguish between a legitimate DNS traffic spike and a DNS amplification flood by examining response patterns, something that pure packet-rate thresholds cannot do.

Agones Third-Party Tools

Flowtriq was added to the Agones Third Party Libraries and Tools page on July 8, 2026, under a new Monitoring section. Agones is the Kubernetes-based game server hosting platform from Google, used by game studios to manage dedicated game server fleets.

Game servers are frequent DDoS targets. When a game server is attacked, the standard response is to drain the affected server and allocate players to a clean instance. Flowtriq integrates with the Agones SDK sidecar REST API to automate this workflow:

1. The ftagent running alongside the game server detects an attack.
2. Flowtriq labels the GameServer with attack metadata via the Agones SDK.
3. The fleet autoscaler detects the label and begins draining the attacked server.
4. Players are reallocated to a clean GameServer instance.

This is the first monitoring tool listed in Agones's third-party directory. For game hosting operators running Agones, it provides a DDoS response workflow that is native to their existing fleet management infrastructure.

awesome-go: NetHawk

NetHawk was accepted into the awesome-go Networking section on June 26, 2026. awesome-go is the canonical curated list of Go projects with over 130,000 GitHub stars. Acceptance requires meeting strict quality standards: CI with passing tests, code coverage reporting, a go.mod file, SemVer releases, and an A- or better Go Report Card grade.

NetHawk is a Go TUI network traffic analyzer that provides real-time per-protocol traffic breakdown, connection tracking, and anomaly detection from the terminal. It is designed for operators who need immediate visibility into what is hitting a server without installing a full monitoring stack.

Being listed in awesome-go puts NetHawk in front of the Go developer community, which overlaps significantly with the infrastructure and DevOps audience that benefits from DDoS visibility tools.

awesome-soc: ftagent-lite

ftagent-lite was accepted into the awesome-soc NIDS (Network Intrusion Detection System) section on July 16, 2026. awesome-soc is a curated list of tools and resources for Security Operations Center teams.

ftagent-lite is the open-source, standalone version of Flowtriq's network monitoring agent. It collects sFlow, NetFlow, and IPFIX telemetry, builds adaptive per-protocol traffic baselines, and raises anomaly alerts when traffic deviates from those baselines. It is MIT-licensed with no vendor lock-in.

Being listed alongside CrowdSec in the NIDS section positions ftagent-lite as a complementary tool for SOC environments. CrowdSec handles IP reputation and crowd-sourced threat intelligence. ftagent-lite handles flow-based volumetric anomaly detection. The two cover different parts of the network security monitoring stack.

Summary

Repository	What Was Added	Merged
zeek/packages	zeek-flowtriq DDoS detection package	Jun 26
avelino/awesome-go	NetHawk in Networking section	Jun 26
agones-dev/agones	Flowtriq in Third Party Tools (Monitoring)	Jul 8
cyb3rxp/awesome-soc	ftagent-lite in NIDS section	Jul 16

Back to Blog

Related Articles