Corelight Zeek is a network security monitoring platform with over 10,000 deployments worldwide. The platform transforms network traffic into compact, high-fidelity transaction logs that enable defenders to understand network activity, detect attacks, and respond to incidents. Zeek operates out-of-band and can be deployed on-premises or in cloud environments. The platform gathers metadata and extracts files from network traffic, formatting the output for integration with SIEM or XDR systems. Zeek serves as the foundation for Corelight's Open NDR Platform. The platform includes enterprise-grade sensors available in multiple form factors and supports monitoring at speeds exceeding 100 Gbps. Built-in integrations include intrusion detection systems (IDS) and Smart PCAP capabilities. The platform is supported by the Corelight team and receives continuous improvements through research conducted by Corelight Labs. Zeek generates structured network metadata that provides visibility into network communications and can be used for threat detection, incident investigation, and forensic analysis. The platform is designed to provide evidence for security operations teams investigating incidents, including ransomware attacks and data exfiltration scenarios.