Zeek
Network SecurityTurn network traffic into structured logs.
Who uses it?
Network security analysts, threat hunters and detection engineers.
Best for
Turning network traffic into searchable logs
Similar tools
Wireshark, Nmap
What is it?
Zeek is an open-source network analysis framework that turns traffic into detailed, structured logs.
What problem does it solve?
Raw packet captures are large and hard to search. Zeek summarises connections and protocols into logs that are easy to query.
How does it work?
Zeek watches network traffic, live or from a capture file. It writes logs for connections, DNS, HTTP, TLS and more. Logs are sent to a SIEM for search and correlation.
Simple example
zeek -r capture.pcapReads a saved capture and writes logs such as conn.log and dns.log.
When would a SOC analyst use it?
When investigators need network context for an alert without storing full packet captures.
How does it work?
- 1Zeek watches network traffic, live or from a capture file.
- 2It writes logs for connections, DNS, HTTP, TLS and more.
- 3Logs are sent to a SIEM for search and correlation.
Simple example
Review Zeek's DNS log to find a host making unusual lookups.
zeek -r capture.pcapReads a saved capture and writes logs such as conn.log and dns.log.
When would a SOC analyst use it?
When investigators need network context for an alert without storing full packet captures.
Who uses it?
Network security analysts, threat hunters and detection engineers.
Pros
- Compact, structured logs
- Rich context for investigations
- Extensible with scripts
Cons
- Needs setup and tuning
- No built-in dashboard
- Learning curve for its scripting language
