Latest news, tutorials, and insights from the Zeek community.
Zeek 9.0, our next long-term support (LTS) release, is just around the corner! Here’s a quick look at what’s been keeping us busy in the lead-up to the release, and what you can expect over the…
read more about Zeek 9.0 Development UpdateThis post provides an overview of the direction the Zeek project is taking around ZeekControl and its intended successor, the Management Framework. The primary and suggested way to run a Zeek deployment for live traffic monitoring…
read more about Beyond ZeekControlWhen an expected log fails to populate, an alert queue explodes, or a custom script behaves strangely, it’s natural to pause and investigate. Running a high-throughput network monitoring engine like Zeek comes with a learning curve,…
read more about The Logs Were Right: Debugging Your Mental Model in ZeekThis is Part 3 of a three-part series. Read Part 1 and Part 2. Introduction Back in Part 1 and Part 2, we presented our motivational package, ip-distance, how you can easily write unit tests in…
read more about The Cure for Exceptional Zeek Package Testing (Part 3)This is Part 2 of a three-part series. Read Part 1 and Part 3. Introduction In the previous part of this blog series, we presented our motivational package, ip-distance, and how you can easily write unit…
read more about The Cure for Exceptional Zeek Package Testing (Part 2)This is Part 1 of a three-part series. Read Part 2 and Part 3. Introduction As someone who ships a lot of Zeek packages to production, I’m always looking for ways to improve package testing. In…
read more about The Cure for Exceptional Zeek Package Testing (Part 1)One year has passed since I last wrote about Spicy’s performance (you can read about that here). In that post, I compared it to Binpac. This will be a simple followup: how much progress have we…
read more about Spicy vs. Binpac Performance, One Year LaterA lot of people who use Zeek have never contributed to it. Not because they don’t have anything to offer, but because they don’t know where to start or assume contributing means writing code they’re not…
read more about We’ve Updated the Zeek Contribution GuideEvery month we pitch a topic to the Zeek community and see what comes back. June’s focus was related to detection techniques: how is everyone actually finding bad things with Zeek, and what tradeoffs come with…
read more about What Actually Catches Threats in a Zeek Deployment?If you have been following our newsletter, you might be aware that we recently added an AI Usage Policy to our project. This follows a lot of other projects doing likewise and took several months of…
read more about There are humans here – how the Zeek project thinks about AI usage