Zeek Network Security Monitor

Zeek (formerly Bro) is a powerful framework for network traffic analysis and security monitoring, originally developed by Vern Paxson at Lawrence Berkeley National Laboratory in 1995. Renamed to Zeek in 2018, it has become a cornerstone of network security monitoring in academia, government, and industry. Key features: deep protocol analysis via built-in analyzers for over 50 protocols including HTTP, HTTPS (via SSL log), DNS, FTP, SMTP, SSH, SSL/TLS, RDP, SMB, Kerberos, DCE/RPC, NFS, and more, extracting metadata from network sessions without requiring payload storage. Connection logging with detailed metadata including timestamps, duration, source and destination addresses, ports, protocols, bytes transferred, and application-layer details. Scripting language (Zeek scripts) for custom analysis, policy enforcement, and event-driven detection logic, enabling analysts to write detection rules and correlation logic. Event-driven architecture where protocol analyzers raise events that trigger user scripts, enabling real-time analysis and response. File analysis framework for extracting, hashing, and analyzing files transferred over the network (HTTP downloads, email attachments, SMB transfers). Intelligence integration for correlating observed indicators (IPs, domains, URLs, file hashes) with threat intelligence feeds. TLS certificate analysis for detecting suspicious certificates and man-in-the-middle attacks. Detecting lateral movement, data exfiltration, and command-and-control communication through protocol anomaly detection. Cluster support for distributing analysis across multiple Zeek instances for high-throughput monitoring. Integration with SIEM platforms, ELK stack, Splunk, and threat intelligence platforms. Offline pcap analysis for forensic investigation of captured traffic. Cross-platform on Linux and FreeBSD. Used by National Laboratories, financial institutions, and CSIRT teams worldwide.