Zeek Workshop · Berkeley September 10–11, 2026 — Register →
GitHub Get Zeek

Open Source Network Security

An Open Source Network Security Monitoring Tool

Flexible, open source, and powered by defenders.

Get Zeek
View on GitHub

About Zeek

Zeek and Ye Shall Find

Zeek has been a cornerstone of the open-source and cybersecurity communities for decades. Originally developed by Vern Paxson in the 1990s under the name “Bro,” Zeek was designed to provide deep insights into network activity across university and national lab networks.

Unlike traditional security tools such as firewalls or intrusion prevention systems, Zeek is not an active defense mechanism. Instead, it operates quietly on a sensor—whether hardware, software, virtual, or cloud-based—analyzing network traffic in real-time.

Zeek captures high-fidelity transaction logs, file contents, and customizable data outputs, which are ideal for manual review or integration into SIEM systems for security analysts.

  • Passive Monitoring

    Silently observes network traffic without interfering with operations

  • Rich Logging

    Generates detailed, structured logs of all network activity

  • Highly Extensible

    Custom scripts and packages extend functionality to any use case

By the Numbers

Trusted by defenders everywhere

  • 70+

    Log files provided by default

  • 3,000+

    Network events tracked

  • 10,000+

    Deployments worldwide

  • 7,700+

    GitHub stars

  • 20+

    Years of federally-funded R&D

  • 270+

    Community-contributed packages

Capabilities

Deep network insight

Zeek provides the foundation for understanding what’s really happening on your network.

  • Protocol Analysis

    Deep inspection of application-layer protocols including HTTP, DNS, SSL/TLS, SSH, and many more.

  • Threat Detection

    Identify suspicious patterns, known attack signatures, and anomalous behavior in your network.

  • Comprehensive Logging

    Generate rich, structured logs perfect for forensics, compliance, and integration with your SIEM.

  • Scriptable & Extensible

    The Zeek scripting language allows you to customize and extend functionality for your specific needs.

  • High Performance

    Designed to handle high-throughput networks, from small labs to large enterprise deployments.

  • Network Visibility

    Get complete visibility into what’s happening on your network, who’s talking to whom, and what data is flowing.

Community

Join the Zeek Community

We’re a global community of security researchers, analysts, and defenders working together to make networks safer. We share what we know, help each other work through problems, and get together at workshops and conferences throughout the year.

Learn More

  • Join the Conversation

    Connect directly with Zeek users and the core team to share what you’re working on and tap into a community that’s been running Zeek in production for years.

    Join Slack

  • Ask a Question

    Search thousands of answered questions or post your own. Our forum is where the deep technical knowledge of the Zeek community lives.

    Visit Our Forum

  • Attend an Event

    Meet the people behind Zeek. Monthly community calls keep you connected to what’s in progress, and our in-person workshops put you in the room with practitioners from across the community.

    View Events

Ready to see your network clearly?

Join thousands of security teams using Zeek to gain deep visibility into their network traffic. It’s free, open source, and ready for production.

Get Zeek
Read Documentation