Zeek

zeek.org
Awesome Privacy➔ Networking➔ Self-Hosted Network Security➔ Zeek
Zeek

Detect if you have a malware-infected computer on your network, and powerful network analysis framework and monitor.

Also Consider

Open Source

Zeek Source Code

Author

zeek

Description

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

#bro#dfir#ndr#network-monitoring#nsm#pcap#security#zeek

Homepage

https://www.zeek.org

Repository

  • LicenseOther
  • Created06 Jul 12
  • Primary languageC++
  • Size285,866 KB
  • Stars8,114
  • Forks1,438
  • Watchers8,114

Language Usage

Language Usage

Project Health

  • Last commit1 day ago
  • Open issues263
  • Latest releasev9.1.0-dev

Top Contributors

Recent Commits

  • zeek-bot(16 Oct 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Tim Wojtulewicz(15 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/delay-btest-waiting-for-external-program-startup' * origin/topic/timw/delay-btest-waiting-for-external-program-startup: Delay briefly for redis-server to start up in redis btests Delay briefly for dnsmasq to start up in dns_mgr btests

  • Tim Wojtulewicz(12 Oct 26)

    Delay briefly for redis-server to start up in redis btests

  • Tim Wojtulewicz(12 Oct 26)

    Delay briefly for dnsmasq to start up in dns_mgr btests

  • Arne Welzel(15 Oct 26)

    Revert "Merge branch 'topic/jgras/improve-zmq-cluster-started' of https://github.com/J-Gras/zeek" This reverts commit 25c490d4c8e30cb174bb64184297c762a028e4c6, reversing changes made to 810a601d5c55dbc5e0f7f8e5dbb6d40867a87b6f. Reason is that the cluster/websocket/broker/match-all-subscription.zeek became very flaky due to this.

  • Arne Welzel(15 Oct 26)

    Merge branch 'topic/jgras/improve-zmq-cluster-started' of https://github.com/J-Gras/zeek * 'topic/jgras/improve-zmq-cluster-started' of https://github.com/J-Gras/zeek: Have cluster_started cover all zeek_init subscriptions

  • Jan Grashoefer(13 Oct 26)

    Have cluster_started cover all zeek_init subscriptions Peers raise Cluster::node_up (which drives the cluster_started handshake) upon seeing a node's nodeid_topic subscription, so for cluster_started to cover all other subscriptions, nodeid_topic must be the last subscription a node emits during zeek_init. Move the setup to &priority=-1000. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

  • Arne Welzel(15 Oct 26)

    Merge branch 'fix/5965-non-rfc-compliant-banners' of https://github.com/Gido822/zeek * 'fix/5965-non-rfc-compliant-banners' of https://github.com/Gido822/zeek: SSH: Remove trailing whitespace from set_version test output SSH: Accept any SSH- version string SSH: Add test for a non-RFC 4253 version string

  • Arne Welzel(15 Oct 26)

    Merge remote-tracking branch 'origin/topic/awelzel/doc-metric-index' * origin/topic/awelzel/doc-metric-index: doc/troubleshooting: Use zeek:metric for demonstration purposes ci,doc: Add auto-generated Metrics page into Reference section doc/ext/zeek.py: Add zeek:metric directive and role zeekygen: Add MetricTarget and MetricInfo classes telemetry/Manager: Add GetFamilies() accessor for registered metric families telemetry/MetricFamily: Allow Name(), Unit() and HelpText() introspection

  • Arne Welzel(28 Sept 26)

    doc/troubleshooting: Use zeek:metric for demonstration purposes

  • Arne Welzel(28 Sept 26)

    ci,doc: Add auto-generated Metrics page into Reference section Not overly pretty, but it's a start.

  • Arne Welzel(28 Sept 26)

    doc/ext/zeek.py: Add zeek:metric directive and role This allows creating a metric entry via the following directive: .. zeek:metric: zeek_the_metric_name :Type: gauge :Label: label1 label2 label3 And within documentation, can use :zeek:metric:`the_metric_name` to create and xref to the metric list.

  • Arne Welzel(28 Sept 26)

    zeekygen: Add MetricTarget and MetricInfo classes

  • Arne Welzel(28 Sept 26)

    telemetry/Manager: Add GetFamilies() accessor for registered metric families

  • Arne Welzel(27 Sept 26)

    telemetry/MetricFamily: Allow Name(), Unit() and HelpText() introspection The existing MetricFamily instances do not provide accessors for these. Add them for documentation generation purposes. Technically this is a breaking change, but I'm assuming here that Counter, Gauge and Histogram are not instantiated outside the telemetry/Manager accessors.

  • Arne Welzel(15 Oct 26)

    Merge remote-tracking branches 'origin/dependabot/github_actions/actions/checkout-7.0.1', 'origin/dependabot/github_actions/dawidd6/action-send-mail-22', 'origin/dependabot/github_actions/actions/upload-artifact-7.0.2' and 'origin/dependabot/github_actions/hendrikmuhs/ccache-action-1.2.24' * origin/dependabot/github_actions/actions/checkout-7.0.1: Bump actions/checkout from 5.1.0 to 7.0.1 * origin/dependabot/github_actions/dawidd6/action-send-mail-22: Bump dawidd6/action-send-mail from 16 to 22 * origin/dependabot/github_actions/actions/upload-artifact-7.0.2: Bump actions/upload-artifact from 4.6.2 to 7.0.2 * origin/dependabot/github_actions/hendrikmuhs/ccache-action-1.2.24: Bump hendrikmuhs/ccache-action from 1.2.22 to 1.2.24

  • dependabot[bot](15 Oct 26)

    Bump hendrikmuhs/ccache-action from 1.2.22 to 1.2.24 Bumps [hendrikmuhs/ccache-action](https://github.com/hendrikmuhs/ccache-action) from 1.2.22 to 1.2.24. - [Release notes](https://github.com/hendrikmuhs/ccache-action/releases) - [Commits](https://github.com/hendrikmuhs/ccache-action/compare/v1.2.22...f09c25b45002a07be2955cbe52e8cee55643f89d) --- updated-dependencies: - dependency-name: hendrikmuhs/ccache-action dependency-version: 1.2.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

  • dependabot[bot](15 Oct 26)

    Bump actions/upload-artifact from 4.6.2 to 7.0.2 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...cf430e030ddbb5b0abf93d22962f4752f3646cd9) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

  • dependabot[bot](15 Oct 26)

    Bump dawidd6/action-send-mail from 16 to 22 Bumps [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail) from 16 to 22. - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](https://github.com/dawidd6/action-send-mail/compare/d38f3f7cd391cdebfe0d38efc3998b935e951c4f...67ce3558d613188179559c61d3565140cf389968) --- updated-dependencies: - dependency-name: dawidd6/action-send-mail dependency-version: '22' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

  • dependabot[bot](15 Oct 26)

    Bump actions/checkout from 5.1.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 5.1.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5.1.0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

  • Arne Welzel(15 Oct 26)

    Merge remote-tracking branch 'origin/topic/awelzel/github-actions-pin-hash-version-comment' * origin/topic/awelzel/github-actions-pin-hash-version-comment: github: Add dependabot.yml config file github/workflows: Pin uses: actions/...

  • Gido822(13 Oct 26)

    SSH: Remove trailing whitespace from set_version test output

  • Tim Wojtulewicz(13 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/cci-fix-python-installation' * origin/topic/timw/cci-fix-python-installation: CCI: Make sure latest python is in pyenv on macOS

  • Tim Wojtulewicz(13 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/libpcap-1.11.0-btest' * origin/topic/timw/libpcap-1.11.0-btest: Make core.pcap.filter-warning btest more resilient to output changes

  • Tim Wojtulewicz(13 Oct 26)

    Merge remote-tracking branch 'origin/topic/timw/update-private-commit-hash' * origin/topic/timw/update-private-commit-hash: Update zeek-testing-private commit hash for GSSAPI changes

  • Arne Welzel(13 Oct 26)

    github: Add dependabot.yml config file For automatic maintenance of GitHub Actions.

  • Arne Welzel(13 Oct 26)

    github/workflows: Pin uses: actions/... Use the pinact [1] to pin everything to the hash-version-comemnt style. This does not upgrade them, mostly to see if dependabot comes along and does it for us when needed. This excludes the build_fuzzers and run_fuzzers actions from Google. The workflow for these is taken from the official docs at [2] and the repo doesn't contain tags. [1] https://github.com/suzuki-shunsuke/pinact [2] https://google.github.io/oss-fuzz/getting-started/continuous-integration/

  • zeek-bot(13 Oct 26)

    Docs: Regenerated via GitHub workflow [nomail] [skip ci]

  • Gido822(12 Oct 26)

    SSH: Accept any SSH- version string Relax the DPD signatures to SSH- and treat versions not starting with 1 as SSH2.

  • Gido822(12 Oct 26)

    SSH: Add test for a non-RFC 4253 version string

Zeek Security

6.9/10

Repo Security Summary

Updated 24 Aug 26 Fuzz tested

  • Code-Review6/10
  • Maintained10/10
  • CII-Best-Practices0/10
  • License9/10
  • Security-Policy9/10
  • Branch-ProtectionN/A
  • Dangerous-Workflow10/10
  • Signed-Releases8/10
  • Token-Permissions0/10
  • Packaging10/10
  • Fuzzing10/10
  • SAST0/10
  • Binary-Artifacts10/10
  • Pinned-Dependencies2/10

Security Advisories (25)

Zeek Website

Website

Zeek: The Open Source Network Monitor

The Open Source Network Monitor Flexible, scriptable, and powered by defenders. Get Zeek View on GitHub About Zeek Zeek and Ye Shall Find Zeek has been a cornerstone of the open-source and cybersecurity communities for decades. Originally developed by Vern Paxson in the 1990s under the name "Bro," Zeek was designed to provide deep insights…

Redirects

Redirects to https://zeek.org/

Security Checks

All 65 security checks passed

Server Details

  • IP Address192.0.78.150
  • LocationSan Francisco,California,United States of America,NA
  • ISPAutomattic Inc
  • ASNAS2635

Associated Countries

  • USUS
  • CACA
  • JPJP

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

zeek.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Zeek Reviews

More Self-Hosted Network Security

View More...

About the Data: Zeek

Edit Zeek Data

You can edit Zeek's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Zeek Submit Edit to Zeek Add alternative

API

You can access Zeek's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/zeek

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Zeek

Help your friends compare Self-Hosted Network Security, and pick privacy-respecting software and services.
Share Zeek and Awesome Privacy with your network!

← Previous

PF Sense

View Self-Hosted Network Security (8)
Next →

Firezone