Zeek
Zeek is an open source network security monitor and network analysis framework. Originally written by Vern Paxson in the mid-1990s under the name Bro, it has been a cornerstone of the open-source security community for decades. Unlike a firewall or an intrusion prevention system, Zeek is not an active defence mechanism: it sits passively on a sensor — hardware, virtual or cloud-based — and turns raw network traffic into high-fidelity, structured logs that describe what actually happened on the wire.
Key Features
- Deep protocol analysis — ships with analyzers for a large set of protocols, giving high-level, semantic understanding at the application layer instead of raw packet dumps.
- Structured, high-fidelity logs — produces 70+ log files by default (conn, dns, http, ssl, files, notice and more) and tracks 3,000+ network events, so analysts work with transaction records rather than captures.
- Scriptable — Zeek’s domain-specific scripting language lets you express site-specific monitoring policies, custom detections and new log output.
- Highly stateful — it keeps extensive application-layer state and builds a high-level archive of a network’s activity over time.
- Built for performance — designed for high-throughput networks and used operationally at large sites.
- Extensible — the Zeek Package Manager (zkg) and a community library of 280+ packages add protocol support, detections and tooling.
- SIEM-friendly — log output is ideal for manual review or ingestion into a SIEM and analytics pipeline.
- Cluster-ready — ZeekControl and the Management framework handle both standalone and clustered deployments.
Why Use Zeek?
Most network tools answer “is this packet bad?”. Zeek answers “what is happening on my network?” — and it does so with data you can query later. Because it writes normalised, tab-separated logs instead of packet captures, you can retain weeks of activity cheaply, correlate it with other telemetry and build detections on top of it. Its scripting language means a single sensor can serve as a protocol monitor, a file-extraction engine, an asset-inventory feed and a custom detector at the same time, without changing the underlying capture.
Use Cases
- Network visibility and monitoring — keep an authoritative record of connections, DNS lookups, TLS sessions and transferred files.
- Threat hunting and incident response — pivot through retained logs to reconstruct what a host did before, during and after a compromise.
- Security operations and SIEM enrichment — feed conn/dns/http/ssl logs into a SIEM to power correlation and alerting.
- Custom detection engineering — write site-specific Zeek scripts for the traffic patterns that matter to you.
- Research and education — a standard platform for academic network measurement and teaching.
Platform
Linux · macOS · FreeBSD — official binary packages are available through the openSUSE Build Service (deb/rpm), Homebrew, MacPorts and FreshPorts, and Zeek builds from source on any POSIX-like system.
Licence
Free and open source — BSD-3-Clause. Zeek is distributed under a three-clause BSD licence (The Regents of the University of California, through the Lawrence Berkeley National Laboratory and the International Computer Science Institute), permitting free use with virtually no restrictions.