Zeek Blog

ZPC-3 Developers Phase Open

The 3rd Zeek Package Contest (ZPC-3) is currently underway!  In the first phase of this contest, community members had the chance to submit their ideas for a compelling new Zeek package.  Here are the submissions we received:  Package to detect known C2...

read more

Zeek 3.2 Released

(This is an updated version of the previous RC announcement.) We are very happy to make Zeek 3.2 available today. Some highlights of the new release include: Zeek now supports synchronizing tables/sets across clusters through a backing Broker data store. The same...

read more

Zeek Mailing List Migration

We recently migrated our mailing lists to a new mailing list host - and domain. All of our mailing lists are now hosted at lists.zeek.org; this includes the interface to join the list, as well as the list archives. This also means that all of our mailing lists now use...

read more

7 Dos And Don’ts For Zeek Scripting

This post serves as an introduction to some of the pitfalls I had to learn about whilst writing scripts. Hopefully, they help you avoid the same pitfalls. In some of the below example code snippets, bold font is used to emphasize a particular pitfall. If you’d like to...

read more

Got Zoom ?

I still find it amazing what you can find quite simply with Zeek.  Since Zoom seems to be on top of mind for many recently, as an example to show how easily you can highlight specific traffic with great accuracy and granularity, I wrote this simple PoC package...

read more