Corelight Zeek

Zeek (formerly known as Bro) is an open source network analysis framework designed for network security monitoring and traffic analysis. The project provides a powerful platform that differs from traditional intrusion detection systems by offering deep network visibility and the ability to analyze network traffic at multiple protocol layers. Zeek operates as a network security monitor that passively observes network traffic and generates logs and alerts based on customizable scripts and policies.

The framework is maintained by a Leadership Team consisting of contributors from multiple organizations including the International Computer Science Institute, Corelight, Lawrence Berkeley National Laboratory, Indiana University, Mozilla Foundation, ESnet, and other academic and research institutions. The project operates under the Software Freedom Conservancy as an open source initiative with community governance.

Zeek supports extensibility through custom scripts and plugins, allowing security teams to tailor the framework to their specific monitoring needs. The project maintains an active community with mailing lists, IRC channels, and annual ZeekWeek events. Users can develop and share packages to extend Zeek's functionality for various network analysis use cases. The framework generates detailed logs of network activity that can be used for security investigations, incident response, and network forensics.