Corelight Zeek
Open source network security monitoring tool for traffic analysis
Data verified May 2026
ADYour product here. Reach security decision-makers.Launch a campaignCorelight Zeek Description
Zeek is an open source network security monitoring tool originally developed in the 1990s under the name "Bro" and renamed in 2018. The tool operates as a passive network analysis system that runs on sensors (hardware, software, virtual, or cloud-based) to analyze network traffic in real-time. Zeek functions differently from active defense mechanisms like firewalls or intrusion prevention systems. It captures and analyzes network activity to generate high-fidelity transaction logs, file contents, and customizable data outputs. The tool provides visibility into network communications by tracking network events and producing detailed log files. The platform is designed for manual review by security analysts or integration into SIEM systems for centralized security monitoring. Zeek offers extensibility through community-contributed packages and can be customized to meet specific monitoring requirements. The project has been federally funded for over 20 years and is currently supported by Corelight. Zeek has a deployment base of over 10,000 installations worldwide and maintains an active open source community that contributes to its development through code, documentation, and feature enhancements.
Corelight Zeek FAQ
Common questions about Corelight Zeek including features, pricing, alternatives, and user reviews.
Corelight Zeek is Open source network security monitoring tool for traffic analysis, developed by Zeek. It is a Network Security solution designed to help security teams with Open Source, Zeek, Network Monitoring.
Corelight Zeek offers the following core capabilities:
1.Real-time network traffic analysis
2.High-fidelity transaction log generation
3.File content capture
4.Customizable data outputs
5.70+ default log files
6.3,000+ network event tracking
7.Community package ecosystem with 270+ packages
8.SIEM integration support
9.Passive network monitoring
10.Sensor deployment across hardware, software, virtual, and cloud platforms
Learn more at https://cybersectools.com/tools/corelight-zeek
Corelight Zeek is a free Network Security tool. This makes it accessible for organizations of all sizes, from startups to enterprises. Visit https://zeek.org/ for download and installation instructions.
Popular alternatives to Corelight Zeek include:
1.Corelight Open NDR Platform - Network detection and response platform with IDS, NSM, and threat intel. (Commercial)
2.Critical Path Security Léargas Platform - Zeek-based network traffic analysis & IDS platform for enterprise deployments. (Commercial)
3.GQUIC Protocol Analyzer - A Zeek-based protocol analyzer that parses GQUIC traffic to extract connection metadata and create fingerprints for detecting anomalous network behavior. (Free)
4.Stamus Clear NDR Community - Open source Suricata-based NDR system with threat detection and analysis (Free)
5.Netis Cloud Probe - An open source packet capture and forwarding tool that captures network packets on one machine and sends them to another for remote monitoring and analysis. (Free)
Compare these tools and more at https://cybersectools.com/categories/network-security
Corelight Zeek is for security teams and organizations that need Open Source, Zeek, Network Monitoring. It's particularly suitable for small to medium-sized teams looking for cost-effective solutions. Other Network Security tools can be found at https://cybersectools.com/categories/network-security
Have more questions? Browse our categories or search for specific tools.
