Latest news, tutorials, and insights from the Spicy category.
One year has passed since I last wrote about Spicy’s performance (you can read about that here). In that post, I compared it to Binpac. This will be a simple followup: how much progress have we…
read more about Spicy vs. Binpac Performance, One Year LaterWhether you’re extending Zeek’s functionality or integrating it into a larger NDR stack, your work probably involves some form of source code. While that code is ultimately a means to an end, I like code to…
read more about Developing Zeek Scripts with StyleWe’re proud to announce the release of Zeek 8.0! This release introduces a range of technical innovations and culminates architectural improvements we’ve been working on since the release of Zeek 7 a year ago. Customizable Flow…
read more about Introducing Zeek 8Within Zeek, there are two separate parser generators: Binpac (the old one) and Spicy (the new one). Both allow users to write protocol parsers by declaring what the protocol looks like rather than writing C++ code…
read more about Are Spicy parsers slower than Binpac parsers?The Zeek team is proud to announce Zeek 7.2! Work on this release began in December 2024 and includes some 1,200 commits, 330 merged pull requests, and 130 closed issues. The 7.2 release brings important new…
read more about Introducing Zeek 7.2In our last post, we left off with a functional but incomplete analyzer for Redis. It analyzed RESP (Redis Serialization Protocol) traffic, crudely created “command” objects, then sent that off into Zeek script in events in…
read more about Building a Redis Analyzer with Spicy, Part IIYou can find the source code referenced throughout this post here — though, it is quite different from what is written here. Redis is an in-memory, key-value database. Its primary use is for caching. It does…
read more about Building a Redis Analyzer with SpicyIn this video, Keith Jones (Sr. Security Researcher, Corelight) introduces a simple Python program written to help you take your Zeek ASCII tab delimited files and make them full text searchable with ElasticSearch+Kibana (or OpenSearch, if…
read more about Zeek In Action, Video 12, zeek2esIn this video, Keith Jones (Sr. Security Researcher, Corelight) builds on a previous Zeek in Action video and shows how you can use spicy-driver to quickly debug (and improve!) the Radius code we built in that…
read more about Zeek in Action, Video 11, Using Spicy DriverIn this Zeek in Action video, Keith Jones explains his Spicy protocol analyzer rapid development process on a new Radius analyzer. Of course Radius is in core Zeek, but it can be replaced with a Spicy…
read more about Zeek In Action, Video 9, Radius Protocol Analyzer with Spicy