by Johanna Amann | Apr 29, 2026 | How-to, logging
Zeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both. There are several reasons one might want two log formats simultaneously. For...
by Michelle Pathe | Mar 31, 2026 | community, How-to
Blocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this noise. Aaron Scantlin from...
by Benjamin Bannier | Dec 8, 2025 | development, How-to, Scripting, Spicy
Whether you’re extending Zeek’s functionality or integrating it into a larger NDR stack, your work probably involves some form of source code. While that code is ultimately a means to an end, I like code to be neat: fit for the task, to the point,...
RSS - Posts