Zeek
Zeek (formerly Bro) is an open source network security monitoring platform. Instead of matching signatures and raising alerts, it parses network traffic and writes structured logs describing what happened: every connection with its duration and bytes, every DNS query and answer, HTTP requests, TLS handshakes and certificates, file transfers, SMB and Kerberos activity, and protocol anomalies. Those logs become a compact, searchable record of network behavior — invaluable for threat hunting, incident investigations, and baselining.
Zeek is also a programmable analysis engine. Its event-driven scripting language lets teams add detections, extract new fields, and match threat intelligence in real time. Many security teams run Zeek alongside Suricata — Zeek for rich context, Suricata for signature alerts — correlated through shared flow identifiers.
TL;DR
- Zeek turns traffic into protocol logs:
conn,dns,http,ssl,x509,files,smb,kerberos,notice,weird, and more. - Deploy sensors on taps or span ports; scale with a cluster of manager, logger, proxy, and worker processes.
- Write logs as JSON and ship them to a SIEM or data lake; query locally with zeek-cut and jq.
- Extend Zeek with scripts that raise notices, the Intelligence framework for indicators, and packages from the Zeek package manager.
- Correlate with Suricata and endpoint data using Community ID.
- Use logs to hunt: beaconing, long connections, rare TLS certificates and server names, DNS anomalies, and unusual internal protocols.
Quick Example
Processing a packet capture and asking common investigation questions:
A Zeek script that raises a notice for unusually long connections:
Core Concepts
What Zeek Logs
Logs share a UID per connection, so a DNS query, the following TLS session, and a file transfer can be joined.
Deployment
Place sensors where traffic is visible — internet egress, between segments, and in front of critical assets — fed by network taps or span ports (or cloud traffic mirroring). A single process handles modest links; higher throughput uses a Zeek cluster: workers (packet analysis, load-balanced by flow using AF_PACKET or similar), proxies, a logger, and a manager. Monitor packet drops and memory; missed packets mean missing logs. See Packet Capture and Network Diagnostics.
Logging and Integration
Load policy/tuning/json-logs to write JSON, and ship logs to a SIEM, data lake, or search platform. Retain metadata longer than full packet captures — it is much smaller and answers most investigation questions. Enable Community ID logging so flows can be matched with Suricata alerts and other tools. See Security Information and Event Management and Suricata.
Scripting, Intelligence, and Packages
Zeek's scripting language reacts to events (connection_established, dns_request, ssl_established, file_hash) and can add fields, write new logs, and raise notices. The Intelligence framework loads indicator files (IP addresses, domains, URLs, file hashes, certificate hashes) and logs matches wherever those values appear in traffic. The Zeek package manager (zkg) installs community packages for additional protocols, detections, and integrations.
Hunting With Zeek Logs
Baseline normal behavior first; hunting is about outliers relative to your network. Feed confirmed findings into detections. See DNS and Security Incident Response.
Best Practices
Treat Logs as the Product
Ensure logs are complete (no drops), parsed into your SIEM, and retained long enough for investigations.
Correlate Across Tools
Use connection UIDs and Community ID to join Zeek logs with alerts and endpoint data.
Script Small, Targeted Detections
Add notices for specific behaviors in your environment and test them on packet captures.
Keep Intelligence Fresh
Update indicator feeds regularly and review intel matches for relevance.
Common Mistakes
Sensors That Miss Traffic
Logs Nobody Can Query
Alerting on Every Notice
FAQ
What is Zeek used for?
Network security monitoring: producing detailed, structured logs of network activity for threat hunting, investigations, and detection, with a scripting language for custom analysis.
How is Zeek different from Suricata?
Zeek emphasizes rich protocol logs and programmable analysis; Suricata emphasizes signature-based detection and can block traffic inline. They complement each other.
What is conn.log?
Zeek's summary of every connection, including endpoints, ports, protocol, duration, bytes transferred, and connection state — the foundation for most network investigations.
Can Zeek analyze encrypted traffic?
It cannot read encrypted payloads, but it logs TLS metadata such as versions, server names, and certificate details, plus connection patterns that reveal suspicious behavior.
How do I scale Zeek for high-traffic networks?
Run a Zeek cluster with multiple worker processes and load-balanced packet capture, size hardware for peak traffic, and monitor packet drops.
Related Topics
- Security Detection Engineering — Building and maintaining detections
- Suricata — Signature-based network detection
- Packet Capture and Network Diagnostics — Capturing traffic for analysis
- Security Information and Event Management — Centralizing Zeek logs
- DNS — A rich source of hunting signals
- Security Incident Response — Using network logs in investigations