Latest news, tutorials, and insights by Michelle Pathe.
A lot of people who use Zeek have never contributed to it. Not because they don’t have anything to offer, but because they don’t know where to start or assume contributing means writing code they’re not…
read more about We’ve Updated the Zeek Contribution GuideEvery month we pitch a topic to the Zeek community and see what comes back. June’s focus was related to detection techniques: how is everyone actually finding bad things with Zeek, and what tradeoffs come with…
read more about What Actually Catches Threats in a Zeek Deployment?Our annual community survey is live, and we want to hear from you! It takes less than ten minutes to complete, responses are anonymous, and your answers will directly shape what the team behind the Zeek…
read more about The 2026 Zeek Project Survey Is Now OpenThe Zeek Project has run surveys before, but we don’t often share what happens after the feedback comes in. Last year, over 90 people responded and that data has been driving decisions ever since. Before we…
read more about The 2026 Zeek Project Survey: Coming June 23Most conversations about sensor placement focus on where to tap. Perimeter, core network, east-west segments. Pick your spot and start capturing. But one contributor to this month’s community discussion put it in a way that resonated:…
read more about Zeek Sensor Placement in Practice: Tapping What You Actually UnderstandGetting Zeek deployed is one thing. Keeping it running well is another, and it looks different for every environment. Last month, we asked the Zeek community: once Zeek is in production, what does the ongoing care…
read more about How Do You Know Zeek Is Working? What Practitioners Actually MonitorA Zeek user spent years maintaining a careful system of named test PCAPs, tracking which scripts belonged to which tests and building a testing workflow from scratch. Then they discovered btest, Zeek’s built-in testing framework that…
read more about The Hidden Features of ZeekClose to 100 people gathered at CERN in Geneva on March 25-26 for Zeek Workshop Europe 2026. The two-day event brought together practitioners from across Europe for knowledge sharing, training, and networking. The workshop kicked off…
read more about Zeek Workshop Europe 2026 RecapBlocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple HookYour first Zeek script doesn’t need to detect malware, stop threats, or solve a critical security problem. In fact, it probably shouldn’t. David Fitz learned Zeek through a SANS course and wanted to try his first…
read more about Your First Zeek Script Doesn’t Need to Be Perfect