Corelight Zeek

Zeek is an open source network security monitoring tool originally developed in the 1990s under the name "Bro" and renamed in 2018. The tool operates as a passive network analysis system that runs on sensors (hardware, software, virtual, or cloud-based) to analyze network traffic in real-time.

Zeek functions differently from active defense mechanisms like firewalls or intrusion prevention systems. It captures and analyzes network activity to generate high-fidelity transaction logs, file contents, and customizable data outputs. The tool provides visibility into network communications by tracking network events and producing detailed log files.

The platform is designed for manual review by security analysts or integration into SIEM systems for centralized security monitoring. Zeek offers extensibility through community-contributed packages and can be customized to meet specific monitoring requirements.

The project has been federally funded for over 20 years and is currently supported by Corelight. Zeek has a deployment base of over 10,000 installations worldwide and maintains an active open source community that contributes to its development through code, documentation, and feature enhancements.