Zeek

zeek.org
Awesome Privacy➔ Networking➔ Intrusion Detection➔ Zeek
Zeek

Zeek (formally Bro) Passively monitors network traffic and looks for suspicious activity.

Also Consider

Open Source

Zeek Source Code

Author

zeek

Description

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

#bro#dfir#ndr#network-monitoring#nsm#pcap#security#zeek

Homepage

https://www.zeek.org

Repository

  • LicenseOther
  • Created06 Jul 12
  • Primary languageC++
  • Size287,075 KB
  • Stars8,080
  • Forks1,431
  • Watchers8,080

Language Usage

Language Usage

Project Health

  • Last commit7 days ago
  • Open issues258
  • Latest releasev9.1.0-dev

Top Contributors

Recent Commits

  • Arne Welzel(07 Oct 26)

    Merge remote-tracking branch 'VoDongVan/topic/vodongvan/dhcpv6' * VoDongVan/topic/vodongvan/dhcpv6: NEWS/DHCPv6: Minor whitespace and NEWS updates NEWS: Mention the new DHCPv6 analyzer testing: Add DHCPv6 analyzer baseline tests Add a DHCPv6 analyzer

  • Arne Welzel(06 Oct 26)

    NEWS/DHCPv6: Minor whitespace and NEWS updates

  • Benjamin Bannier(05 Oct 26)

    Merge branch 'topic/bbannier/openssl-4.0'

  • Benjamin Bannier(05 Oct 26)

    Fix test baseline for differences between openssl-3 and openssl-4 We directly expose key identifiers from openssl in logs. With openssl-4 the displayed information changed for a single key used in tests which now causes a test to fail with that version. This patch normalizes the displayed information to remove differences among openssl versions. We were previously also installing only `openssl@3` on macos in CI which masked the issue, but this is not a realistic option on non-CI machines since other packages like `wget` might pull in `openssl@4` which Zeek's configure script would prefer.

  • Arne Welzel(05 Oct 26)

    Merge remote-tracking branch 'origin/topic/awelzel/agents-skills-scapy-pcap' * origin/topic/awelzel/agents-skills-scapy-pcap: Add scapy-pcap skill under .agents/skills

  • Arne Welzel(24 Sept 26)

    Add scapy-pcap skill under .agents/skills The AGENTS.md file and btest.rst documentation have been semi-useful in guiding agents to produce good PCAP generator scripts. Usually extra and repeated prompting is required for a nice result. This commit introduces an scapy-pcap AGENT skill into .agents/skills using the agentskills.io standard to avoid repeated prompting. This skill has been useful for me locally and was created using Claude Opus 4.8 itself after cleaning up two or three PCAP generator scripts. It containes a few instructions me and others have stumbled over repeatedly: Deterministic timestamps, high-level Scapy API usage, gzip compression, ... The advantage of an agent skill is that it should only be loaded on demand rather than being in the context all the time. This won't work with Claude out of the box, but symlinking from .claude to .agents does the trick, and so should linking from .claude/skills to .agents/skills if one uses a custom .claude directory. Codex, on the other hand, should pick up .agents/skills by default and there's hope Claude will at some point as well.

  • Tim Wojtulewicz(01 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/deprecation-removal-followup' * origin/topic/timw/deprecation-removal-followup: Add removed method/field to NEWS as breaking changes Regenerate docs again Remove broker::Manager::AdvanceTime() Remove references to broker store attributes from docs Remove broker_backend field from script_id type

  • Tim Wojtulewicz(01 Oct 26)

    Add removed method/field to NEWS as breaking changes

  • Tim Wojtulewicz(24 Sept 26)

    Regenerate docs again

  • Tim Wojtulewicz(23 Sept 26)

    Remove broker::Manager::AdvanceTime()

  • Tim Wojtulewicz(23 Sept 26)

    Remove references to broker store attributes from docs

  • Tim Wojtulewicz(23 Sept 26)

    Remove broker_backend field from script_id type

  • Evan Typanski(01 Oct 26)

    Merge remote-tracking branch 'origin/topic/etyp/osxroot-include-fixes' * origin/topic/etyp/osxroot-include-fixes: CMake: stop compiling unused HighwayHash nanobenchmark Add missing direct includes

  • Evan Typanski(30 Sept 26)

    CMake: stop compiling unused HighwayHash nanobenchmark

  • Evan Typanski(30 Sept 26)

    Add missing direct includes This surfaced from using --osx-sysroot to 26 after 27 released. Not sure why.

  • Tim Wojtulewicz(30 Sept 26)

    Merge remote-tracking branch 'origin/topic/timw/force-openssl-path-on-cci-macos-builds' * origin/topic/timw/force-openssl-path-on-cci-macos-builds: CI: Force openssl path on macOS builds

  • Tim Wojtulewicz(29 Sept 26)

    CI: Force openssl path on macOS builds

  • Benjamin Bannier(25 Sept 26)

    Merge branch 'topic/bbannier/windows-test-bifs-sleep' [skip ci]

  • Benjamin Bannier(25 Sept 26)

    Disable test `bifs.sleep` on Windows [skip ci] This test is currently flaky on Windows. The reason seems to be that Zeek currently does not use high-resolution timers on Windows so we only get a clock resolution around 15ms, https://learn.microsoft.com/en-us/windows/win32/sysinfo/acquiring-high-resolution-time-stamps.

  • Arne Welzel(25 Sept 26)

    Merge remote-tracking branch 'origin/topic/awelzel/bump-zeekctl-zeek-9-fixes-around-websockets' * origin/topic/awelzel/bump-zeekctl-zeek-9-fixes-around-websockets: Bump zeekctl

  • Tim Wojtulewicz(24 Sept 26)

    Merge remote-tracking branch 'origin/topic/timw/include-cleanup-again' * origin/topic/timw/include-cleanup-again: Remove unused includes from various files

  • Arne Welzel(24 Sept 26)

    Merge remote-tracking branch 'origin/topic/awelzel/broker-allow-complex-type-follow-up' * origin/topic/awelzel/broker-allow-complex-type-follow-up: Attr: Improve error message for removed &broker_allow_complex attribute

  • Arne Welzel(24 Sept 26)

    Merge remote-tracking branch 'origin/topic/awelzel/pre-commit-check-added-large-files' * origin/topic/awelzel/pre-commit-check-added-large-files: pre-commit: Add check-added-large-files

  • Arne Welzel(24 Sept 26)

    pre-commit: Add check-added-large-files Had a pretty big PCAP mistakenly added in a branch and nothing flagged it. There's a ready-made pre-commit hook for this, so use it. Default limit is 500kb, lower to 200kb for now, but could see it also increased if that's too small. It's not checking existing files, even when running pre-commit run -a.

  • Arne Welzel(24 Sept 26)

    Attr: Improve error message for removed &broker_allow_complex attribute ...and a minimal test for the removed Broker store attributes.

  • zeek-bot(24 Sept 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz(22 Sept 26)

    Remove unused includes from various files

  • Tim Wojtulewicz(23 Sept 26)

    Merge remote-tracking branch 'origin/topic/timw/remove-v9.1-deprecations' * origin/topic/timw/remove-v9.1-deprecations: Remove broker set/table/vector/record script-level methods Restore error for &backend attribute Deprecate old version of TableVal::Assign/Remove Update zeekctl submodule for deprecation removals Regenerate docs for 9.1 deprecation removals Remove all code associated with Broker stores Btest updates for 9.1 deprecation removals Remove 9.1 deprecations

  • Tim Wojtulewicz(22 Sept 26)

    Remove broker set/table/vector/record script-level methods

  • Tim Wojtulewicz(21 Sept 26)

    Restore error for &backend attribute

Zeek Security

6.9/10

Repo Security Summary

Updated 24 Aug 26 Fuzz tested

  • Code-Review6/10
  • Maintained10/10
  • CII-Best-Practices0/10
  • License9/10
  • Security-Policy9/10
  • Branch-ProtectionN/A
  • Dangerous-Workflow10/10
  • Signed-Releases8/10
  • Token-Permissions0/10
  • Packaging10/10
  • Fuzzing10/10
  • SAST0/10
  • Binary-Artifacts10/10
  • Pinned-Dependencies2/10

Security Advisories (25)

Zeek Website

Website

Zeek: The Open Source Network Monitor

The Open Source Network Monitor Flexible, scriptable, and powered by defenders. Get Zeek View on GitHub About Zeek Zeek and Ye Shall Find Zeek has been a cornerstone of the open-source and cybersecurity communities for decades. Originally developed by Vern Paxson in the 1990s under the name "Bro," Zeek was designed to provide deep insights…

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address192.0.78.212
  • LocationSan Francisco,California,United States of America,NA
  • ISPAutomattic Inc
  • ASNAS2635

Associated Countries

  • USUS
  • CACA
  • JPJP

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

zeek.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Zeek Reviews

More Intrusion Detection

  • Kismet

    Kismet

    kismetwireless.net

    An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.

    Open Source kismetwireless/kismet
    View Kismet Report
  • OSSEC

    OSSEC

    ossec.net

    OSSEC is an Open Source host-based intrusion detection system, that performs log analysis, integrity checking, monitoring, rootkit detection, real-time alerting and active response.

    Open Source ossec/ossec-hids
    View OSSEC Report
  • picosnitch

    picosnitch

    elesiuta.github.io/picosnitch

    picosnitch helps protect your security and privacy by "snitching" on anything that connects to the internet, letting you know when, how much data was transferred, and to where. It uses BPF to monitor network traffic per application, and per parent to cover those that just call others. It also hashes every executable, and will complain if some mischievous program is giving it trouble.

    Open Source elesiuta/picosnitch
    View picosnitch Report
  • Snare

    Snare

    snaresolutions.com/products/snare-central

    SNARE (System iNtrusion Analysis and Reporting Environment) is a series of log collection agents that facilitate centralized analysis of audit log data. Logs from the OS are collected and audited. Full remote access, through a web interface easy to use manually, or by an automated process.

    Not Open Source
    View Snare Report
View More...

About the Data: Zeek

Edit Zeek Data

You can edit Zeek's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Zeek Submit Edit to Zeek Add alternative

API

You can access Zeek's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/zeek

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Zeek

Help your friends compare Intrusion Detection, and pick privacy-respecting software and services.
Share Zeek and Awesome Privacy with your network!

View Intrusion Detection (5)
Next →

OSSEC