Zeek

zeek.org
Zeek

Zeek (formally Bro) Passively monitors network traffic and looks for suspicious activity.

Open Source

Zeek Source Code

Author

zeek

Description

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

#bro#dfir#ndr#network-monitoring#nsm#pcap#security#zeek

Homepage

https://www.zeek.org

License

NOASSERTION

Created

06 Jul 12

Last Updated

29 Jul 26

Latest version

v9.0.0-dev

Primary Language

C++

Size

281,042 KB

Stars

7,826

Forks

1,390

Watchers

7,826

Language Usage

Language Usage

Star History

Star History

Top Contributors

Recent Commits

  • zeek-bot (29 Jul 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz (28 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/5691-init-prometheus-via-zeek-init' * origin/topic/timw/5691-init-prometheus-via-zeek-init: Initialize the Prometheus listener via zeek_init()

  • Tim Wojtulewicz (24 Jul 26)

    Initialize the Prometheus listener via zeek_init()

  • Johanna Amann (28 Jul 26)

    Merge remote-tracking branch 'origin/topic/johanna/cmp0219' cmake submodule update only * origin/topic/johanna/cmp0219: Fix CMP0219 warning for newer cmake versions

  • Arne Welzel (28 Jul 26)

    Merge branch 'topic/yacin/support-i-s-regex-input-framework' of https://github.com/ynadji/zeek * 'topic/yacin/support-i-s-regex-input-framework' of https://github.com/ynadji/zeek: add support for trailing pattern flags in Input Framework

  • Johanna Amann (28 Jul 26)

    Fix CMP0219 warning for newer cmake versions This pulls in zeek/cmake#153

  • Tim Wojtulewicz (28 Jul 26)

    Merge remote-tracking branch 'origin/topic/vern/bifcl-line-directives' * origin/topic/vern/bifcl-line-directives: Restore checking for mismatches in coverage commands Fix clang-tidy warning from bifcl changes fix bifcl to provide #line information in BiF shims as well as BiF natives typo in Val.h comment

  • Tim Wojtulewicz (28 Jul 26)

    Restore checking for mismatches in coverage commands This partially reverts https://github.com/zeek/zeek/commit/ce9cd1d5a46e885a6d03b867731bd5febf4ee3ca

  • Tim Wojtulewicz (27 Jul 26)

    Fix clang-tidy warning from bifcl changes

  • Vern Paxson (27 Jul 26)

    fix bifcl to provide #line information in BiF shims as well as BiF natives

  • Vern Paxson (27 Jul 26)

    typo in Val.h comment

  • Benjamin Bannier (27 Jul 26)

    Merge branch 'topic/bbannier/websocketshim-test-speedup'

  • Benjamin Bannier (03 Jul 26)

    Speed up WebSocketShim unit tests These tests were using pretty large timeout values which made them the main contributors to the unit test suite's runtime. There is no reason for them to be so large, so we can decrease them substantially to speed up the test suite (on my machine before: 2.2s, after: 0.8s). With that change the runtime of the unit test suite is limited by how fast Zeek can set itself up (parse scripts, set up globals, ...).

  • Tim Wojtulewicz (24 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/upgrade-gitpython-for-docs-builds' * origin/topic/timw/upgrade-gitpython-for-docs-builds: Upgrade GitPython to 3.1.55 to fix dependabot warnings

  • Tim Wojtulewicz (24 Jul 26)

    Upgrade GitPython to 3.1.55 to fix dependabot warnings

  • Yacin Nadji (15 Jul 26)

    add support for trailing pattern flags in Input Framework

  • Tim Wojtulewicz (24 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/upgrade-gitpython-for-docs-builds' * origin/topic/timw/upgrade-gitpython-for-docs-builds: Upgrade GitPython to 3.1.51 to fix dependabot warnings

  • Tim Wojtulewicz (24 Jul 26)

    Upgrade GitPython to 3.1.51 to fix dependabot warnings

  • Tim Wojtulewicz (24 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/fix-additional-tags-for-image-creation' * origin/topic/timw/fix-additional-tags-for-image-creation: CI: Return/use additional tags as a bash array during image creation

  • Tim Wojtulewicz (24 Jul 26)

    CI: Return/use additional tags as a bash array during image creation

  • Christian Kreibich (23 Jul 26)

    Merge branch 'topic/christian/docs-inline-edits' * topic/christian/docs-inline-edits: Docs: edits on top of #5679

  • Christian Kreibich (21 Jul 26)

    Docs: edits on top of #5679

  • Arne Welzel (23 Jul 26)

    Merge remote-tracking branch 'origin/topic/awelzel/cmake-install-bif-headers-fix-empty-dirs' * origin/topic/awelzel/cmake-install-bif-headers-fix-empty-dirs: src/CMakeLists: Switch bif header installation to GLOB_RECURSE

  • Arne Welzel (23 Jul 26)

    Merge remote-tracking branch 'origin/topic/awelzel/cluster-no-drop-flaky' * origin/topic/awelzel/cluster-no-drop-flaky: btest/cluster/zeromq: Attempt to make no-drop tests less flaky

  • Arne Welzel (23 Jul 26)

    btest/cluster/zeromq: Attempt to make no-drop tests less flaky Instead of publishing a fixed number of messages (which could sometimes lead to timeouts on slow systems), publish for a fixed duration of 5 seconds and ensure a certain minimum amount of messages made it through and no drops observed.

  • Arne Welzel (23 Jul 26)

    src/CMakeLists: Switch bif header installation to GLOB_RECURSE Saw in #5712 that a new empty dhcpv6 include directory was created due to the use of install(DIRECTORY ...). Switch this to GLOB_RECURSE in a CODE section to run at installation time. As can be seen in the baseline changes, this removes a few more spuriously empty directories as well as the cyclic symlink <PREFIX>/include/zeek/include/zeek construct. Relates to #5681, #5678

  • zeek-bot (23 Jul 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz (23 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/fix-flood-of-warnings-from-spicyz' * origin/topic/timw/fix-flood-of-warnings-from-spicyz: Remove additional compiler-warning flags for spicyz Mark some variables in spicyz/glue-compiler as maybe_unused Initialize variable potentially used uninitialized Fix warning about implicit conversion from double to uint64_t Fix Windows warning about unused parameter Fix warning about printf type in ZeroMQ backend Use /W4 when building spicyz on Windows instead of /Wall

  • Tim Wojtulewicz (22 Jul 26)

    Remove additional compiler-warning flags for spicyz

  • Tim Wojtulewicz (23 Jul 26)

    Merge remote-tracking branch 'origin/topic/timw/temporarily-put-a-bandaid-on-coverage-errors' * origin/topic/timw/temporarily-put-a-bandaid-on-coverage-errors: Temporarily put a band-aid over broken coverage script so builds complete

Zeek Security

7.1/10

Repo Security Summary

Updated 13 Jul 26 Fuzz tested

  • Code-Review 9/10
  • Maintained 10/10
  • Dangerous-Workflow 10/10
  • Security-Policy 9/10
  • CII-Best-Practices 0/10
  • Token-Permissions 0/10
  • License 9/10
  • Packaging 10/10
  • Fuzzing 10/10
  • Signed-Releases 8/10
  • Branch-Protection N/A
  • Binary-Artifacts 10/10
  • SAST 0/10
  • Pinned-Dependencies 1/10

Zeek Website

Website

The Zeek Network Security Monitor

Zeek (formerly Bro) is the world’s leading platform for network security monitoring. Flexible, open source, and powered by defenders.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address 192.0.78.212
  • Location San Francisco, California, United States of America, NA
  • ISP Automattic Inc
  • ASN AS2635

Associated Countries

  • US US
  • CA CA
  • FR FR

Safety Score

Website marked as safe

100%

Blacklist Check

zeek.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Zeek Reviews

More Intrusion Detection

About the Data: Zeek

API

You can access Zeek's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/zeek

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Zeek

Help your friends compare Intrusion Detection, and pick privacy-respecting software and services.
Share Zeek and Awesome Privacy with your network!

View Intrusion Detection (5)