Zeek

Zeek (formerly Bro) is a premier open-source network security monitoring (NSM) and behavioral traffic analysis framework engineered to provide deep, structured visibility into network activity and security communications. Unlike traditional signature-based intrusion detection systems that search for specific packet strings and alert on known exploits, Zeek operates as a network analysis platform and behavioral interpreter. The engine inspects raw network traffic in real time, translating low-level packet streams into high-level, structured, and human-readable transaction logs covering protocols such as HTTP, DNS, TLS, SSH, SMTP, and FTP. Zeek’s built-in stateful analysis engine tracks network sessions across long time horizons, extracting rich metadata including SSL/TLS certificate chains, software user agents, DNS query answers, and transferred file hashes (MD5/SHA-1/SHA-256). The framework features a turing-complete, event-driven domain scripting language that allows security engineers to write custom detection logic, track behavioral anomalies, and automate active threat response workflows. Zeek generates structured, tab-delimited or JSON logs that integrate seamlessly with Elasticsearch, Splunk, and modern security data pipelines, providing network defenders and SOC analysts with an indispensable tool for network forensics and threat hunting.