Network security monitoring and traffic analysis framework
Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.
Zeek observes network traffic passively and writes structured logs that describe what happened: connections, DNS queries, HTTP requests, TLS certificates, files and much more. Instead of only signature alerts, it gives analysts a detailed record of network activity for detection, hunting and forensics.
Its event-driven scripting language lets teams write custom detections and protocol analysis, and a package manager distributes community extensions. Zeek is often deployed next to a signature IDS such as Suricata.
BSD-3-Clause · BSD 3-Clause License · Open source
GitHub does not detect the licence; the COPYING file is the BSD 3-clause text.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
25 published advisories for Zeek in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-694c-w947-hm9jhigh2026-09-03
MIME: Analyzer allows headers to grow without bound in HTTP/SMTP
GHSA-2xc9-g36m-w7jhhigh2026-08-19
SMB: Chains of AndX messages can crash Zeek
GHSA-px95-jfxw-4jw2high2026-08-19
DNP3: Memory exhaustion via file control (g70v1) fields
GHSA-wjf9-326g-m9h3high2026-08-19
SIP: Memory exhaustion from long request/response paths
GHSA-hxj7-pcq9-c949high2026-08-19
DHCP: Memory exhaustion from retained options after analyzer violation
GHSA-49x5-fmqq-4ccvhigh2026-08-19
SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries
GHSA-qjhc-rfmf-3vgpmedium2026-08-19
Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch
GHSA-rmc2-mqq6-wcw9high2026-08-19
SMB: DCE/RPC memory exhaustion from fragment state
GHSA-q48f-3qm2-j875medium2026-08-19
UDP: udp_contents events could trigger out-of-bounds reads
GHSA-3gxr-8f49-vrgrhigh2026-08-19
Analyzer manager: Equivalent scheduled analyzers could exhaust memory
GHSA-gq9q-85wf-mq48medium2026-08-19
NetBIOS: Memory exhaustion from declared session lengths
GHSA-c573-w89f-fpxmhigh2026-08-19
Redis: Parsed Redis traffic memory exhaustion
Sources: GitHub repository advisories · checked 2026-10-20.
Network IDS, IPS and security monitoring engine
High-performance network threat detection engine from the OISF: signature-based IDS/IPS, protocol logging and file extraction in one multi-threaded engine.
Rule-based network intrusion prevention system
The next generation of the Snort IPS, maintained by Cisco Talos: multi-threaded, with a new rule parser and Lua-based configuration.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
