Zeek

Zeek is an open-source network security monitoring platform that helps defenders understand what is happening across network traffic without depending on packet inspection alone. Instead of functioning like a traditional firewall or endpoint agent, Zeek analyzes network activity and produces structured events that can be searched, correlated and used for investigation. Its scripting framework allows security teams and researchers to extend detection logic for their own environments. Zeek is commonly used for network security monitoring, threat hunting, incident investigation and research because it can provide rich context around protocols, connections and application behavior. The project is particularly valuable when organizations need scalable network telemetry that can feed existing security analytics and detection workflows. Its open architecture also makes it suitable for teams that want control over how network evidence is collected and interpreted. The result is a flexible source of network evidence that can support both routine monitoring and detailed investigations when an incident occurs.