zeek/zeek

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

7908 stars · 1402 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Zeek (formerly Bro) is an open-source network security monitor and analysis framework that passively inspects network traffic and produces high-fidelity transaction logs. It includes a domain-specific scripting language for writing custom monitoring policies and protocol analyzers for deep application-layer inspection.

Use cases

• monitor network traffic for suspicious activity
• analyze pcap files for security investigations
• generate structured logs of HTTP, DNS, TLS and SSH traffic
• detect anomalies and known attack signatures on a network
• build custom network detection policies with a scripting language
• feed network telemetry into a SIEM
• audit network usage and capacity planning

When to choose

• you need deep, stateful, application-layer visibility into network traffic
• you want a programmable, extensible network monitoring framework rather than a fixed-rule IDS
• you need high-performance passive monitoring on high-traffic networks
• you want rich structured logs for DFIR or SIEM ingestion

When to avoid

• you need active inline blocking or prevention rather than passive monitoring
• you want a simple point-and-click IDS with no scripting
• you lack the resources to deploy and maintain a sensor on your network
• you only need host-based security monitoring

Facets

framework · maturity stable

security monitoring networking parser logging security networking monitoring developer-tools bsd cross-platform cli network-security-monitor ids nsm dfir pcap-analysis traffic-analysis scripting-language intrusion-detection linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="zeek/zeek")