# Corelight Zeek

Corelight Zeek is a Network Detection and Response product by Corelight. It runs in the cloud or on-premises (hybrid). Pricing is free.

Open source network security monitoring tool for traffic analysis

Checked October 2026.

## What is Corelight Zeek?

Zeek is an open source network security monitoring tool originally developed in the 1990s under the name "Bro" and renamed in 2018. The tool operates as a passive network analysis system that runs on sensors (hardware, software, virtual, or cloud-based) to analyze network traffic in real-time.

Zeek functions differently from active defense mechanisms like firewalls or intrusion prevention systems. It captures and analyzes network activity to generate high-fidelity transaction logs, file contents, and customizable data outputs. The tool provides visibility into network communications by tracking network events and producing detailed log files.

The platform is designed for manual review by security analysts or integration into SIEM systems for centralized security monitoring. Zeek offers extensibility through community-contributed packages and can be customized to meet specific monitoring requirements.

The project has been federally funded for over 20 years and is currently supported by Corelight. Zeek has a deployment base of over 10,000 installations worldwide and maintains an active open source community that contributes to its development through code, documentation, and feature enhancements.

Tags: Open Source, Zeek, Network Monitoring

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Network Security](https://cybersectools.com/categories/network-security) · [Network Detection and Response](https://cybersectools.com/categories/ndr)
- Vendor: [Corelight](https://cybersectools.com/companies/corelight)
- Deployment: Hybrid
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- Features: 10 listed
- Integrations: 1 listed
- Website: zeek.org

The full feature and integration lists are on the page for signed-in visitors.

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best SASE Solutions for Business](https://cybersectools.com/shortlists/best-sase-solutions).

## Corelight Zeek FAQ

### What is Corelight Zeek?

Corelight Zeek is a product by Corelight in the Network Detection and Response category. It covers Open Source, Zeek and Network Monitoring.

### What is the pricing for Corelight Zeek?

Corelight Zeek is free. Download and setup instructions are at https://zeek.org/.

### What are alternatives to Corelight Zeek?

Alternatives to Corelight Zeek listed on CybersecTools:

1. [Exabeam NetMon](https://cybersectools.com/tools/exabeam-netmon) - Network monitoring and detection solution for threat analysis (Commercial)
2. [Stamus Networks Clear NDR](https://cybersectools.com/tools/stamus-networks-clear-ndr) - Network detection and response platform for threat detection and analysis (Commercial)
3. [Absolute Insights for Network](https://cybersectools.com/tools/absolute-insights-for-network) - Digital experience monitoring for network, device, and app performance (Commercial)
4. [ManageEngine NetFlow Analyzer](https://cybersectools.com/tools/manageengine-netflow-analyzer) - Flow-based network traffic monitoring and bandwidth analysis tool (Commercial)
5. [Array NTB Series](https://cybersectools.com/tools/array-ntb-series) - Network traffic broker for visibility, monitoring, and traffic optimization (Commercial)

Compare all Corelight Zeek alternatives at [https://cybersectools.com/alternatives/corelight-zeek](https://cybersectools.com/alternatives/corelight-zeek)

### What deployment and organization size does Corelight Zeek fit?

Corelight Zeek is available as cloud or on-premises (hybrid). It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare Corelight Zeek with similar solutions

- [Corelight Zeek vs Exabeam NetMon](https://cybersectools.com/compare/corelight-zeek-vs-exabeam-netmon)
- [Corelight Zeek vs Stamus Networks Clear NDR](https://cybersectools.com/compare/corelight-zeek-vs-stamus-networks-clear-ndr)
- [Corelight Zeek vs Absolute Insights for Network](https://cybersectools.com/compare/absolute-insights-for-network-vs-corelight-zeek)

All alternatives to Corelight Zeek: [/alternatives/corelight-zeek](https://cybersectools.com/alternatives/corelight-zeek)

---

Source: https://cybersectools.com/tools/corelight-zeek

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Corelight Zeek and Corelight: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md