Introducing Zeek 8.2
The Zeek team is proud to announce Zeek 8.2! This release marks our final checkpoint on the road to Zeek 9, and rounds out our new ZeroMQ support in important ways. It also includes a range…
read more about Introducing Zeek 8.2Zeek Blog
Latest news, tutorials, and insights from the Zeek community.
-
-
How Do You Know Zeek Is Working? What Practitioners Actually Monitor
Getting Zeek deployed is one thing. Keeping it running well is another, and it looks different for every environment. Last month, we asked the Zeek community: once Zeek is in production, what does the ongoing care…
read more about How Do You Know Zeek Is Working? What Practitioners Actually Monitor -
How to Write Zeek Logs in JSON & TSV Simultaneously
Zeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both. There are several…
read more about How to Write Zeek Logs in JSON & TSV Simultaneously -
Revisiting Weird-ness: Investigating DNS NOTIFY at Scale
At ESnet, our Zeek deployment was logging 4.2 million weirds per day. When we investigated, 90% were DNS-related and 98% of those came from a single opcode. After submitting a PR to fix it, daily weirds…
read more about Revisiting Weird-ness: Investigating DNS NOTIFY at Scale -
Zeek 8.2 Development Update
The Zeek development team is closing in on Zeek 8.2, our final feature release in the 8.x cycle! This blog post provides a sneak peek at some of the new functionality and changes in that release.…
read more about Zeek 8.2 Development Update -
The Hidden Features of Zeek
A Zeek user spent years maintaining a careful system of named test PCAPs, tracking which scripts belonged to which tests and building a testing workflow from scratch. Then they discovered btest, Zeek’s built-in testing framework that…
read more about The Hidden Features of Zeek -
Zeek Workshop Europe 2026 Recap
Close to 100 people gathered at CERN in Geneva on March 25-26 for Zeek Workshop Europe 2026. The two-day event brought together practitioners from across Europe for knowledge sharing, training, and networking. The workshop kicked off…
read more about Zeek Workshop Europe 2026 Recap -
Reduce conn.log from 35GB to 5GB with a Simple Hook
Blocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple Hook -
Your First Zeek Script Doesn’t Need to Be Perfect
Your first Zeek script doesn’t need to detect malware, stop threats, or solve a critical security problem. In fact, it probably shouldn’t. David Fitz learned Zeek through a SANS course and wanted to try his first…
read more about Your First Zeek Script Doesn’t Need to Be Perfect -
What Should You Actually Customize in Zeek?
You got Zeek running, logs are flowing, and the default configuration is doing its job. And then you hit the wall that almost every Zeek user hits eventually: you know Zeek is extensible, you know you’re…
read more about What Should You Actually Customize in Zeek?