Latest news, tutorials, and insights from the Zeek community.
The Zeek development team is closing in on Zeek 8.2, our final feature release in the 8.x cycle! This blog post provides a sneak peek at some of the new functionality and changes in that release.…
read more about Zeek 8.2 Development UpdateA Zeek user spent years maintaining a careful system of named test PCAPs, tracking which scripts belonged to which tests and building a testing workflow from scratch. Then they discovered btest, Zeek’s built-in testing framework that…
read more about The Hidden Features of ZeekClose to 100 people gathered at CERN in Geneva on March 25-26 for Zeek Workshop Europe 2026. The two-day event brought together practitioners from across Europe for knowledge sharing, training, and networking. The workshop kicked off…
read more about Zeek Workshop Europe 2026 RecapBlocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple HookYour first Zeek script doesn’t need to detect malware, stop threats, or solve a critical security problem. In fact, it probably shouldn’t. David Fitz learned Zeek through a SANS course and wanted to try his first…
read more about Your First Zeek Script Doesn’t Need to Be PerfectYou got Zeek running, logs are flowing, and the default configuration is doing its job. And then you hit the wall that almost every Zeek user hits eventually: you know Zeek is extensible, you know you’re…
read more about What Should You Actually Customize in Zeek?AWS provides a feature that allows mirroring your infrastructure’s network traffic to a separate system for analysis purposes. This is called AWS Traffic Mirroring. If you’d like to use Zeek’s network traffic analysis capabilities in such…
read more about Using Zeek with AWS Traffic Mirroring and KafkaNetwork security monitoring typically focuses on catching threats. But ask Zeek users what they actually discover in their logs, and a different picture emerges: chatty devices wasting bandwidth, misconfigurations creating millions of unnecessary DNS queries, and…
read more about How to Find Operational Problems Hiding in Your Zeek LogsWith zeek-8.1.0 dns.log now includes information on dynamic update messages (RFC 2136) adding new opcode and opcode_name columns. During the RC phase we received feedback that this change to the log schema might break downstream consumers of dns.log, so we also included a…
read more about Why Zeek keeps breaking your test baselinesLearn how to use JA4 network fingerprinting in Zeek to identify client and server software, detect malware, and track behavior across encrypted connections without requiring decryption. Network fingerprinting helps identify client and server software without decrypting…
read more about How to Use JA4 Network Fingerprints in Zeek