Skip to content
This repository has been archived by the owner on Apr 1, 2024. It is now read-only.
/ zeek Public archive
forked from zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

License

Unknown, Unknown licenses found

Licenses found

Unknown
COPYING
Unknown
COPYING.3rdparty
Notifications You must be signed in to change notification settings

brimdata/zeek

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

As Zeek now supports Windows, this repository has been archived. Specific build and packaging steps for Zeek's inclusion with Brimcap and Zui are now covered in the build-zeek repository.


About This Repository

This fork of Zeek was created by the development team at Brim Data for inclusion with Brimcap and the Brim desktop app. Most of the changes relative to mainline Zeek relate to support on Windows for generating Zeek logs from pcaps.

Community contributions are welcomed to assist with upstreaming the changes to mainline Zeek. Issue zeek/951 tracks this effort. As mainlining efforts have seen minimal traction thus far, help would also be appreciated in getting the changes to to work with newer Zeek releases, as the Zeek version on which this fork was based is now quite old.

Zeek Logo

The Zeek Network Security Monitor

A powerful framework for network traffic analysis and security monitoring.

Key FeaturesDocumentationGetting StartedDevelopmentLicense

Follow us on Twitter at @zeekurity.

Key Features

  • In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer.

  • Adaptable and Flexible Zeek's domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach.

  • Efficient Zeek targets high-performance networks and is used operationally at a variety of large sites.

  • Highly Stateful Zeek keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network's activity.

Getting Started

The best place to find information about getting started with Zeek is our web site www.zeek.org, specifically the documentation section there. On the web site you can also find downloads for stable releases, tutorials on getting Zeek set up, and many other useful resources.

You can find release notes in NEWS, and a complete record of all changes in CHANGES.

To work with the most recent code from the development branch of Zeek, clone the master git repository:

git clone --recursive https://github.com/zeek/zeek

With all dependencies in place, build and install:

./configure && make && sudo make install

Write your first Zeek script:

# File "hello.zeek"

event zeek_init()
    {
    print "Hello World!";
    }

And run it:

zeek hello.zeek

For learning more about the Zeek scripting language, try.zeek.org is a great resource.

Development

Zeek is developed on GitHub by its community. We welcome contributions. Working on an open source project like Zeek can be an incredibly rewarding experience and, packet by packet, makes the Internet a little safer. Today, as a result of countless contributions, Zeek is used operationally around the world by major companies and educational and scientific institutions alike for securing their cyber infrastructure.

If you're interested in getting involved, we collect feature requests and issues on GitHub here and you might find these to be a good place to get started. More information on Zeek's development can be found here, and information about its community and mailing lists (which are fairly active) can be found here.

License

Zeek comes with a BSD license, allowing for free use with virtually no restrictions. You can find it here.

About

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Resources

License

Unknown, Unknown licenses found

Licenses found

Unknown
COPYING
Unknown
COPYING.3rdparty

Stars

Watchers

Forks

Packages

No packages published

Languages

  • C++ 48.7%
  • Zeek 46.7%
  • C 2.0%
  • CMake 0.8%
  • Yacc 0.7%
  • Shell 0.5%
  • Other 0.6%