Zeek: network security monitoring that turns traffic into logs

Zeek (about 8,100 stars on GitHub) is an open source network analysis framework that has been in continuous development since Vern Paxson began it at Lawrence Berkeley National Laboratory in 1995. It was called Bro until 2018. Today it is maintained by the Zeek Project under the Linux Foundation with core developers employed by Corelight, a company founded by the original authors, and by research institutions. The code is C++ with a custom scripting language.

What it does

Where a signature based IDS such as Suricata answers the question “did anything known to be bad go past?”, Zeek answers “what exactly happened?”. It passively watches traffic and produces a set of tab separated or JSON log files, one per protocol: conn.log for every connection, dns.log, http.log, ssl.log, files.log and many more. Each line is a compact summary with timestamps, addresses, sizes, durations and protocol specific fields. These logs are small compared with full packet capture but rich enough to reconstruct an incident months later, which is why Zeek is the standard source of network evidence in many security operations centres. Its scripting language lets you add your own analysis, from simple notices to full protocol analysers.

Who it is for

• Security analysts who need a searchable record of network activity for investigations and threat hunting.
• Network administrators who want visibility into which services, certificates and software versions are actually in use.
• Researchers and universities, which have used Zeek for decades as a platform for traffic analysis.
• Operators of SIEM platforms, since Zeek logs ship directly into Elastic, Splunk, Loki and similar tools.

How to install it

Binary packages are available from the project for Debian, Ubuntu, Fedora, Red Hat based distributions and openSUSE, and Zeek is in Homebrew for macOS. A quick test reads a packet capture file instead of a live interface:

zeek --version
zeek -r capture.pcap
ls *.log

For a permanent sensor the zeekctl tool manages a cluster of workers on one or more machines. The documentation has a getting started guide and a complete log reference. Zeek is also included in Security Onion.

Credit

Zeek was created by Vern Paxson and is maintained by the Zeek Project leadership team and community, with the Linux Foundation as its home. It is released under a BSD style licence; see the COPYING file in the repository.