Compare products
Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.
| Product | NetworkMiner by NetworkMiner View product | Zeek by Zeek View product |
|---|---|---|
| Overview | ||
| What it is | NetworkMiner offers host-centric PCAP parsing and automated file and artifact extraction. Use it for network digital forensic analysis. See Network Security alternatives. | What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals. |
| Product type | Network Forensic Analysis Tool & Passive Packet Investigator | Open-Source Network Security Monitoring & Behavioral Analysis Engine |
| Best for | Cybersecurity, Incident Response, Digital Forensics, Defense, Law Enforcement | Cybersecurity, SOC Teams, Network Engineering, Defense, Research, Telecom |
| Pricing | ||
| Pricing model | Contact Vendor | Contact Vendor |
| Free trial | Free trial: yes | Free trial: yes |
| Deployment | ||
| Deployment options | Cloud | CloudOn-Premise |
| Deployment details | Standalone Software; Open Source / Commercial; Standalone Windows Software / Linux Mono Executable | Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual Sensor |
| Data residency | Local Host Machine Only (No Cloud Telemetry) | Customer Infrastructure Dependent (Completely Self-Contained) |
| Key features | ||
| What it offers |
|
|
| Platform & access | ||
| API access | API access: no | API access: no |
| Single sign-on (SSO) | SSO: no | SSO: no |
| Role-based access (RBAC) | RBAC: no | RBAC: yes |
| Multi-tenant | Multi-tenant: no | Multi-tenant: no |
| Mobile app | Mobile app: no | Mobile app: no |
| Supported platforms | PCAP Packet CapturesNetwork InterfacesLive Ethernet Streams | Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps |
| Compliance | GPLv2 (Open Source Edition)ISO 27037 Digital Evidence Principles | BSD LicenseCommon CriteriaNetwork Standards |
| Integrations & coverage | ||
| Integrations | Wireshark PCAP/PCAPNG formatsNetworkMiner ProSnort/Suricata PCAPs | ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight |
| Industries | CybersecurityIncident ResponseDigital ForensicsDefenseLaw Enforcement | CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom |
| Regions | Global | Global |
| Vendor | ||
| Company | NetworkMiner | Zeek |
| Headquarters | Sweden | Berkeley, California, USA |
| Company size | 1-10 | 1-10 |
| Founded | 2007 | 1994 |
Overview
What it is
NetworkMiner
NetworkMiner offers host-centric PCAP parsing and automated file and artifact extraction. Use it for network digital forensic analysis. See Network Security alternatives.Zeek
What does Zeek do? It covers file hash extraction and high-speed packet capture. See typical use cases, self-hosted deployment and how it compares to rivals.Product type
NetworkMiner
Network Forensic Analysis Tool & Passive Packet InvestigatorZeek
Open-Source Network Security Monitoring & Behavioral Analysis EngineBest for
NetworkMiner
Cybersecurity, Incident Response, Digital Forensics, Defense, Law EnforcementZeek
Cybersecurity, SOC Teams, Network Engineering, Defense, Research, TelecomPricing
Pricing model
NetworkMiner
Contact VendorZeek
Contact VendorFree trial
NetworkMiner
Free trial: yesZeek
Free trial: yesDeployment
Deployment options
NetworkMiner
Cloud
Zeek
CloudOn-Premise
Deployment details
NetworkMiner
Standalone Software; Open Source / Commercial; Standalone Windows Software / Linux Mono ExecutableZeek
Open Source; Self-hosted Software; Self-hosted Software Engine; Hardened Appliance; Cloud Virtual SensorData residency
NetworkMiner
Local Host Machine Only (No Cloud Telemetry)Zeek
Customer Infrastructure Dependent (Completely Self-Contained)Key features
What it offers
NetworkMiner
- Host-centric PCAP parsing
- Automated file and artifact extraction
- Passive OS fingerprinting
- Credential harvesting from PCAP
- Passive network sniffing
- Network digital forensic analysis
- Passive host and OS fingerprinting
- PCAP file and artifact reconstruction
Zeek
- Stateful network protocol analysis
- Structured transaction logging (HTTP/DNS/TLS)
- File hash extraction
- Event-driven domain scripting language
- High-speed packet capture
- Network security monitoring
- Network forensic investigation
- Protocol transaction logging
Platform & access
API access
NetworkMiner
API access: noZeek
API access: noSingle sign-on (SSO)
NetworkMiner
SSO: noZeek
SSO: noRole-based access (RBAC)
NetworkMiner
RBAC: noZeek
RBAC: yesMulti-tenant
NetworkMiner
Multi-tenant: noZeek
Multi-tenant: noMobile app
NetworkMiner
Mobile app: noZeek
Mobile app: noSupported platforms
NetworkMiner
PCAP Packet CapturesNetwork InterfacesLive Ethernet Streams
Zeek
Enterprise NetworksDatacenter FabricsMulti-Cloud VPCsMonitoring Taps
Compliance
NetworkMiner
GPLv2 (Open Source Edition)ISO 27037 Digital Evidence Principles
Zeek
BSD LicenseCommon CriteriaNetwork Standards
Integrations & coverage
Integrations
NetworkMiner
Wireshark PCAP/PCAPNG formatsNetworkMiner ProSnort/Suricata PCAPs
Zeek
ElasticsearchSplunkSuricataKafkaArkimeWiresharkCorelight
Industries
NetworkMiner
CybersecurityIncident ResponseDigital ForensicsDefenseLaw Enforcement
Zeek
CybersecuritySOC TeamsNetwork EngineeringDefenseResearchTelecom
Regions
NetworkMiner
Global
Zeek
Global
Vendor
Company
NetworkMiner
NetworkMinerZeek
ZeekHeadquarters
NetworkMiner
SwedenZeek
Berkeley, California, USACompany size
NetworkMiner
1-10Zeek
1-10Founded
NetworkMiner
2007Zeek
1994