Latest news, tutorials, and insights from the Zeek community.
Zeek’s JSON logs can get large quickly, especially if you’re ingesting them into a SIEM that charges by data volume. There are two ways to address this: filtering out uninteresting log lines, and renaming fields to…
read more about Reducing Zeek JSON Log Size: Field Name Mapping and Log Filtering HooksLast week, the Zeek community gathered at the David Brower Center in Berkeley, California for two days of talks, trainings, and conversations about all things Zeek. After an energetic workshop at CERN back in March, we…
read more about Zeek Workshop Berkeley 2026 RecapWe’re proud to announce the release of Zeek 9.0! This long-term support release builds on our work in 8.1 and 8.2, and provides important new ways to communicate events in the cluster, consume encapsulated traffic, and…
read more about Introducing Zeek 9Every month we ask the Zeek community a different question about how they work. This month’s question was about deployment: how do you decide on your architecture, and what would you reconsider? The answers made one…
read more about Why There’s No Single Right Zeek Deployment ArchitectureAlmost no attack begins with an exploit. It begins with a question: What’s out there? Before anyone tries a default password on your VPN gateway or throws an exploit at an unpatched service, they have to…
read more about How Attackers Learn Your Network Before They Attack ItA huge thank you to the 63 of you who took the time to fill out this year’s community survey. Your feedback gives us a clear, honest look at how Zeek fits into your work, and…
read more about 2026 Zeek Project Survey Results: What We Heard and What’s NextZeek 9.0, our next long-term support (LTS) release, is just around the corner! Here’s a quick look at what’s been keeping us busy in the lead-up to the release, and what you can expect over the…
read more about Zeek 9.0 Development UpdateThis post provides an overview of the direction the Zeek project is taking around ZeekControl and its intended successor, the Management Framework. The primary and suggested way to run a Zeek deployment for live traffic monitoring…
read more about Beyond ZeekControlWhen an expected log fails to populate, an alert queue explodes, or a custom script behaves strangely, it’s natural to pause and investigate. Running a high-throughput network monitoring engine like Zeek comes with a learning curve,…
read more about The Logs Were Right: Debugging Your Mental Model in ZeekThis is Part 3 of a three-part series. Read Part 1 and Part 2. Introduction Back in Part 1 and Part 2, we presented our motivational package, ip-distance, how you can easily write unit tests in…
read more about The Cure for Exceptional Zeek Package Testing (Part 3)