Latest news, tutorials, and insights by Michelle Pathe.
You got Zeek running, logs are flowing, and the default configuration is doing its job. And then you hit the wall that almost every Zeek user hits eventually: you know Zeek is extensible, you know you’re…
read more about What Should You Actually Customize in Zeek?AWS provides a feature that allows mirroring your infrastructure’s network traffic to a separate system for analysis purposes. This is called AWS Traffic Mirroring. If you’d like to use Zeek’s network traffic analysis capabilities in such…
read more about Using Zeek with AWS Traffic Mirroring and KafkaNetwork security monitoring typically focuses on catching threats. But ask Zeek users what they actually discover in their logs, and a different picture emerges: chatty devices wasting bandwidth, misconfigurations creating millions of unnecessary DNS queries, and…
read more about How to Find Operational Problems Hiding in Your Zeek LogsLearn how to use JA4 network fingerprinting in Zeek to identify client and server software, detect malware, and track behavior across encrypted connections without requiring decryption. Network fingerprinting helps identify client and server software without decrypting…
read more about How to Use JA4 Network Fingerprints in ZeekThe Zeek team is proud to announce Zeek 8.1! This release achieves a major milestone in our architectural shift away from the Broker messaging backend, includes a bunch of analyzer enhancements, takes first steps to phase…
read more about Introducing Zeek 8.1Zeek rarely works in isolation. The real power comes from pairing it with other tools – SIEMs for log aggregation, IDS/IPS for signature-based detection, threat intel feeds for enrichment, packet capture tools for deeper investigation. We…
read more about 3 Ways to Integrate Zeek With Your Security StackThe first release candidate for Zeek 8.1 is out! This release includes the last major building block in our multi-release effort to move Zeek’s cluster communication off of Broker. Work on this release began in August…
read more about Zeek 8.1 Development UpdateWe recently asked the community something we’ve been curious about for a while: What kind of hardware are you using to run Zeek? What does that setup even look like? What started as a straightforward question…
read more about Common Mistakes When Deploying Zeek (and How to Avoid Them)Plenty of people generate Zeek logs, but not everyone knows what to do with them. We asked the Zeek community to share their real-world approaches, and they delivered. We heard everything from automation scripts to quantum…
read more about 5 Ways the Zeek Community Actually Uses LogsThis summer we ran the Zeek Project Survey to get a clearer picture of how people use Zeek, what challenges they face, and where our team should focus our efforts next. One area we asked about was contribution:…
read more about 5 Ways to Contribute to the Zeek Project for the First Time