Zeek

Zeek is an open source network security monitoring tool, published as flexible, open source and powered by defenders, with packages, documentation across current, long-term support and development versions, an events-based scripting language and an active community.

Zeek occupies a distinct position among network tools and understanding it explains why it underpins so much commercial security software.

Most network security tools produce alerts: they inspect traffic, match it against detection logic and tell you when something matches. Zeek instead produces structured logs describing what happened on the network in protocol-aware terms. Rather than flagging suspicious HTTP, it records every HTTP request with its host, URI, method, response code and file hashes, as data.

The difference matters most in the situation security teams face repeatedly. When an intrusion is discovered, the important questions concern the weeks before anyone noticed, and an alert-based system can only tell you what it flagged at the time. If detection logic did not cover the technique used, there is simply nothing to look at. Zeek's logs record the activity regardless of whether it was interesting at the time, so retrospective investigation becomes possible.

The events-based scripting language is what makes it adaptable rather than fixed. An organisation can write logic for its own protocols, its own environment and threats specific to it, which is not possible with a closed appliance.

The cost is real and should be stated plainly. Zeek produces a large volume of logs requiring storage and something to search them, and it produces no alerts by itself. It is infrastructure for a team that has somewhere to send the data and analysts to use it, not a product that tells you when you have been attacked.

This is precisely why it appears inside commercial products, which package Zeek's telemetry with detection, storage and an interface.

Zeek is free and open source, with commercial support and packaged distributions offered by third parties.