Zeek

Zeek began life as Bro, written by Vern Paxson in the 1990s. It later took its present name. The Zeek Project maintains it under a BSD licence. It is passive. It reads traffic from an interface or from a saved capture and never blocks anything, so it is a monitor and not a firewall or an intrusion prevention system. An event engine takes the packet stream apart up to the application layer and scripts written in Zeek's own language react to events such as a new connection, a DNS answer, an HTTP request or a file transfer. The default scripts write a set of logs, one per protocol or activity, such as conn for every connection, dns, http, ssl and files, in tab-separated or JSON form. Community packages installed with the zkg package manager add parsers and detections.

An investigator meets Zeek in two ways. Either a sensor has been running and its logs already cover the period of interest, or Zeek is run after the fact over a capture to produce logs from it. Every connection carries a unique identifier that appears in all the logs it touched, so an analyst can go from a suspicious DNS answer to the connection it led to and on to the file that was downloaded and its hash. The project's installation guide lists packages for Linux distributions through the openSUSE Build Service, Homebrew on macOS, ports on FreeBSD and OpenBSD and Docker images. At the time of checking the long-term support line was 8.0 and the latest feature release 8.1.