Latest news, tutorials, and insights by Michelle Pathe.
Every month we ask the Zeek community a different question about how they work. This month’s question was about deployment: how do you decide on your architecture, and what would you reconsider? The answers made one…
read more about Why There’s No Single Right Zeek Deployment ArchitectureA huge thank you to the 63 of you who took the time to fill out this year’s community survey. Your feedback gives us a clear, honest look at how Zeek fits into your work, and…
read more about 2026 Zeek Project Survey Results: What We Heard and What’s NextWhen an expected log fails to populate, an alert queue explodes, or a custom script behaves strangely, it’s natural to pause and investigate. Running a high-throughput network monitoring engine like Zeek comes with a learning curve,…
read more about The Logs Were Right: Debugging Your Mental Model in ZeekA lot of people who use Zeek have never contributed to it. Not because they don’t have anything to offer, but because they don’t know where to start or assume contributing means writing code they’re not…
read more about We’ve Updated the Zeek Contribution GuideEvery month we pitch a topic to the Zeek community and see what comes back. June’s focus was related to detection techniques: how is everyone actually finding bad things with Zeek, and what tradeoffs come with…
read more about What Actually Catches Threats in a Zeek Deployment?Our annual community survey is live, and we want to hear from you! It takes less than ten minutes to complete, responses are anonymous, and your answers will directly shape what the team behind the Zeek…
read more about The 2026 Zeek Project Survey Is Now OpenThe Zeek Project has run surveys before, but we don’t often share what happens after the feedback comes in. Last year, over 90 people responded and that data has been driving decisions ever since. Before we…
read more about The 2026 Zeek Project Survey: Coming June 23Most conversations about sensor placement focus on where to tap. Perimeter, core network, east-west segments. Pick your spot and start capturing. But one contributor to this month’s community discussion put it in a way that resonated:…
read more about Zeek Sensor Placement in Practice: Tapping What You Actually UnderstandGetting Zeek deployed is one thing. Keeping it running well is another, and it looks different for every environment. Last month, we asked the Zeek community: once Zeek is in production, what does the ongoing care…
read more about How Do You Know Zeek Is Working? What Practitioners Actually MonitorA Zeek user spent years maintaining a careful system of named test PCAPs, tracking which scripts belonged to which tests and building a testing workflow from scratch. Then they discovered btest, Zeek’s built-in testing framework that…
read more about The Hidden Features of Zeek