Latest news, tutorials, and insights by Michelle Pathe.
When the security cameras on one network weren’t syncing properly, the ntp logs were where one practitioner went looking. It’s the only time they’ve opened those logs, and they didn’t find much that helped, though they’re…
read more about Zeek Data Beyond Threat DetectionOne team won’t start building an alert until someone has written down what it is, why it matters to the organization, what to do when it fires and how to confirm it’s resolved. Another curates and…
read more about Which Zeek Alerts Do You Trust? Practitioners Say It Depends.Last week, the Zeek community gathered at the David Brower Center in Berkeley, California for two days of talks, trainings, and conversations about all things Zeek. After an energetic workshop at CERN back in March, we…
read more about Zeek Workshop Berkeley 2026 RecapEvery month we ask the Zeek community a different question about how they work. This month’s question was about deployment: how do you decide on your architecture, and what would you reconsider? The answers made one…
read more about Why There’s No Single Right Zeek Deployment ArchitectureA huge thank you to the 63 of you who took the time to fill out this year’s community survey. Your feedback gives us a clear, honest look at how Zeek fits into your work, and…
read more about 2026 Zeek Project Survey Results: What We Heard and What’s NextWhen an expected log fails to populate, an alert queue explodes, or a custom script behaves strangely, it’s natural to pause and investigate. Running a high-throughput network monitoring engine like Zeek comes with a learning curve,…
read more about The Logs Were Right: Debugging Your Mental Model in ZeekA lot of people who use Zeek have never contributed to it. Not because they don’t have anything to offer, but because they don’t know where to start or assume contributing means writing code they’re not…
read more about We’ve Updated the Zeek Contribution GuideEvery month we pitch a topic to the Zeek community and see what comes back. June’s focus was related to detection techniques: how is everyone actually finding bad things with Zeek, and what tradeoffs come with…
read more about What Actually Catches Threats in a Zeek Deployment?Our annual community survey is live, and we want to hear from you! It takes less than ten minutes to complete, responses are anonymous, and your answers will directly shape what the team behind the Zeek…
read more about The 2026 Zeek Project Survey Is Now OpenThe Zeek Project has run surveys before, but we don’t often share what happens after the feedback comes in. Last year, over 90 people responded and that data has been driving decisions ever since. Before we…
read more about The 2026 Zeek Project Survey: Coming June 23