Latest news, tutorials, and insights from the Community category.
A Zeek user spent years maintaining a careful system of named test PCAPs, tracking which scripts belonged to which tests and building a testing workflow from scratch. Then they discovered btest, Zeek’s built-in testing framework that…
read more about The Hidden Features of ZeekClose to 100 people gathered at CERN in Geneva on March 25-26 for Zeek Workshop Europe 2026. The two-day event brought together practitioners from across Europe for knowledge sharing, training, and networking. The workshop kicked off…
read more about Zeek Workshop Europe 2026 RecapBlocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple HookYour first Zeek script doesn’t need to detect malware, stop threats, or solve a critical security problem. In fact, it probably shouldn’t. David Fitz learned Zeek through a SANS course and wanted to try his first…
read more about Your First Zeek Script Doesn’t Need to Be PerfectYou got Zeek running, logs are flowing, and the default configuration is doing its job. And then you hit the wall that almost every Zeek user hits eventually: you know Zeek is extensible, you know you’re…
read more about What Should You Actually Customize in Zeek?Network security monitoring typically focuses on catching threats. But ask Zeek users what they actually discover in their logs, and a different picture emerges: chatty devices wasting bandwidth, misconfigurations creating millions of unnecessary DNS queries, and…
read more about How to Find Operational Problems Hiding in Your Zeek LogsZeek rarely works in isolation. The real power comes from pairing it with other tools – SIEMs for log aggregation, IDS/IPS for signature-based detection, threat intel feeds for enrichment, packet capture tools for deeper investigation. We…
read more about 3 Ways to Integrate Zeek With Your Security StackWe recently asked the community something we’ve been curious about for a while: What kind of hardware are you using to run Zeek? What does that setup even look like? What started as a straightforward question…
read more about Common Mistakes When Deploying Zeek (and How to Avoid Them)Plenty of people generate Zeek logs, but not everyone knows what to do with them. We asked the Zeek community to share their real-world approaches, and they delivered. We heard everything from automation scripts to quantum…
read more about 5 Ways the Zeek Community Actually Uses LogsOn October 20, 2025, the Zeek team hosted a full-day training at the NCAR facility in Boulder as part of the NSF Cybersecurity Summit. With 52 registrations and about 50 people showing up, the room was…
read more about Inside Zeek Training at NSF Cybersecurity Summit