Zeek

zeek.org
Awesome Privacy➔ Networking➔ Intrusion Detection➔ Zeek
Zeek

Zeek (formally Bro) Passively monitors network traffic and looks for suspicious activity.

Also Consider

Open Source

Zeek Source Code

Author

zeek

Description

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

#bro#dfir#ndr#network-monitoring#nsm#pcap#security#zeek

Homepage

https://www.zeek.org

Repository

  • LicenseOther
  • Created06 Jul 12
  • Primary languageC++
  • Size290,701 KB
  • Stars8,132
  • Forks1,438
  • Watchers8,132

Language Usage

Language Usage

Project Health

  • Last commit6 days ago
  • Open issues258
  • Latest releasev9.1.0-dev

Top Contributors

Recent Commits

  • Tim Wojtulewicz(23 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/end-of-file-newline-pre-commit' * origin/topic/timw/end-of-file-newline-pre-commit: Fix all of the files with missing newlines Add pre-commit to check for missing newlines at end of files

  • Tim Wojtulewicz(23 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/pre-commit-cmake-format-py15' * origin/topic/timw/pre-commit-cmake-format-py15: Use shimmed version of cmake-format precommit for Python 3.15

  • Tim Wojtulewicz(22 Oct 26)

    Use shimmed version of cmake-format precommit for Python 3.15

  • zeek-bot(23 Oct 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz(22 Oct 26)

    Merge remote-tracking branch 'Gido822/fix/6002-ntlm-oem-strings' * Gido822/fix/6002-ntlm-oem-strings: NTLM: decode OEM strings as bytes, not UTF-16 Add test for NTLM unicode

  • Tim Wojtulewicz(22 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/l2tp' * origin/topic/timw/l2tp: Add basic L2TP analyzer and btest

  • Tim Wojtulewicz(22 Oct 26)

    Fix all of the files with missing newlines

  • Tim Wojtulewicz(22 Oct 26)

    Add pre-commit to check for missing newlines at end of files

  • Tim Wojtulewicz(14 Oct 26)

    Add basic L2TP analyzer and btest

  • Tim Wojtulewicz(22 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/ci-macos-27' * origin/topic/timw/ci-macos-27: CI: Fix macOS to use brew python version correctly Update c-ares submodule to v1.34.9 CCI: Add xcode-27 build, drop xcode-16 build GHCI: Add xcode-27 build, drop macos-16 build

  • Tim Wojtulewicz(22 Oct 26)

    Merge remote-tracking branch 'origin/topic/johanna/distrust-eMudhra' * origin/topic/johanna/distrust-eMudhra: Distrust the eMudhra ECC Root G3

  • Tim Wojtulewicz(21 Oct 26)

    CI: Fix macOS to use brew python version correctly

  • Tim Wojtulewicz(21 Oct 26)

    Update c-ares submodule to v1.34.9 This includes a fix for building with Xcode 27 but not macOS 27. It also updates the vcpkg submodule to a version that includes the c-ares update.

  • Tim Wojtulewicz(12 Oct 26)

    CCI: Add xcode-27 build, drop xcode-16 build

  • Tim Wojtulewicz(12 Oct 26)

    GHCI: Add xcode-27 build, drop macos-16 build

  • Johanna Amann(22 Oct 26)

    Distrust the eMudhra ECC Root G3 The Comodo CA that can be used in cross-signs was already distrusted for 8.0 in 1daead9edd. Closes GH-6004

  • Tim Wojtulewicz(21 Oct 26)

    Merge remote-tracking branch 'origin/topic/etyp/shallow-clone-submodules' * origin/topic/etyp/shallow-clone-submodules: Use `--depth 1` in CircleCI Shallow-clone Zeek submodules by default

  • Tim Wojtulewicz(21 Oct 26)

    Merge remote-tracking branch 'origin/topic/etyp/configure-nicer-opts' * origin/topic/etyp/configure-nicer-opts: Accept space-separated configure option arguments Support -G generator shorthand in configure

  • Gido822(21 Oct 26)

    NTLM: decode OEM strings as bytes, not UTF-16 The analyzer ignored the unicode parameter of its string type and ran every string through utf16_to_utf8_val(). MS-NLMP negotiated-charset string are only UTF-16 when NTLMSSP_NEGOTIATE_UNICODE is set, and the NEGOTIATE message's domain and workstation are always in the OEM character set (2.2.1.1), whatever the flags say.

  • Gido822(21 Oct 26)

    Add test for NTLM unicode

  • Arne Welzel(21 Oct 26)

    Merge remote-tracking branch 'origin/topic/awelzel/move-iShark5060-to-TheMrMilchmann' * origin/topic/awelzel/move-iShark5060-to-TheMrMilchmann: GHCI: Switch to TheMrMilchMann/setup-msvc-dev

  • Arne Welzel(19 Oct 26)

    GHCI: Switch to TheMrMilchMann/setup-msvc-dev This action seems a bit more popular than the iShark5060 version. Related discussion here: https://github.com/zeek/zeek/pull/5982#issuecomment-6188433396

  • zeek-bot(21 Oct 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/dependabot/github_actions/docker/build-push-action-7.4.0' * origin/dependabot/github_actions/docker/build-push-action-7.4.0: build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/dependabot/github_actions/github/codeql-action/upload-sarif-4.39.0' * origin/dependabot/github_actions/github/codeql-action/upload-sarif-4.39.0: build(deps): bump github/codeql-action/upload-sarif

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/dependabot/github_actions/actions/cache-6.1.0' * origin/dependabot/github_actions/actions/cache-6.1.0: build(deps): bump actions/cache from 5.0.5 to 6.1.0

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/dependabot/github_actions/docker/setup-buildx-action-4.4.1' * origin/dependabot/github_actions/docker/setup-buildx-action-4.4.1: build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.4.1

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/circleci-ignore-dependabot-prs' * origin/topic/timw/circleci-ignore-dependabot-prs: CCI: Disable builds from dependabot PRs

  • Tim Wojtulewicz(20 Oct 26)

    Update zeek-testing-private commit hash

  • Tim Wojtulewicz(20 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/circleci-skip-full-build-on-weekly-run' * origin/topic/timw/circleci-skip-full-build-on-weekly-run: CCI: Skip full build on weekly job

Zeek Security

6.9/10

Repo Security Summary

Updated 24 Aug 26 Fuzz tested

  • Code-Review6/10
  • Maintained10/10
  • CII-Best-Practices0/10
  • License9/10
  • Security-Policy9/10
  • Branch-ProtectionN/A
  • Dangerous-Workflow10/10
  • Signed-Releases8/10
  • Token-Permissions0/10
  • Packaging10/10
  • Fuzzing10/10
  • SAST0/10
  • Binary-Artifacts10/10
  • Pinned-Dependencies2/10

Security Advisories (25)

Zeek Website

Website

Zeek: The Open Source Network Monitor

The Open Source Network Monitor Flexible, scriptable, and powered by defenders. Get Zeek View on GitHub About Zeek Zeek and Ye Shall Find Zeek has been a cornerstone of the open-source and cybersecurity communities for decades. Originally developed by Vern Paxson in the 1990s under the name "Bro," Zeek was designed to provide deep insights…

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address192.0.78.212
  • LocationSan Francisco,California,United States of America,NA
  • ISPAutomattic Inc
  • ASNAS2635

Associated Countries

  • USUS
  • CACA
  • JPJP

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

zeek.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Zeek Reviews

More Intrusion Detection

  • Kismet

    Kismet

    kismetwireless.net

    An 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.

    Open Source kismetwireless/kismet
    View Kismet Report
  • OSSEC

    OSSEC

    ossec.net

    OSSEC is an Open Source host-based intrusion detection system, that performs log analysis, integrity checking, monitoring, rootkit detection, real-time alerting and active response.

    Open Source ossec/ossec-hids
    View OSSEC Report
  • picosnitch

    picosnitch

    elesiuta.github.io/picosnitch

    picosnitch helps protect your security and privacy by "snitching" on anything that connects to the internet, letting you know when, how much data was transferred, and to where. It uses BPF to monitor network traffic per application, and per parent to cover those that just call others. It also hashes every executable, and will complain if some mischievous program is giving it trouble.

    Open Source elesiuta/picosnitch
    View picosnitch Report
  • Snare

    Snare

    snaresolutions.com/products/snare-central

    SNARE (System iNtrusion Analysis and Reporting Environment) is a series of log collection agents that facilitate centralized analysis of audit log data. Logs from the OS are collected and audited. Full remote access, through a web interface easy to use manually, or by an automated process.

    Not Open Source
    View Snare Report
View More...

About the Data: Zeek

Edit Zeek Data

You can edit Zeek's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Zeek Submit Edit to Zeek Add alternative

API

You can access Zeek's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/zeek

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Zeek

Help your friends compare Intrusion Detection, and pick privacy-respecting software and services.
Share Zeek and Awesome Privacy with your network!

View Intrusion Detection (5)
Next →

OSSEC