Zeek (formerly Bro) is the world’s leading platform for network security monitoring. Flexible, open source, and powered by defenders.

Nov 5, 2025 · Development If you are interested in following development, clone Zeek from our GitHub repository. We are also making nightly Linux binaries available that are cut from the master …

Oct 13, 2025 · Many operators use Zeek as a network security monitor (NSM) to support investigations of suspicious or malicious activity. Zeek also supports a wide range of traffic analysis tasks beyond …

Zeek supports network operations at a broad variety of sites, including major corporations, universities, research labs, and supercomputing centers. It’s also used widely by researchers to prototype novel …

(Note that "Zeek" is the new name of what used to be known as the "Bro" network monitoring system. The old "Bro" name still frequently appears in the system's documentation and workings, including in …

With its powerful, network-optimized programming language, vibrant open-source community, and global adoption, Zeek offers the insights needed to tackle the toughest network challenges across …

Nov 5, 2025 · Most users, however, run Zeek on a computer selected solely for the purpose of network security monitoring. Security personnel call that computer a “sensor” and they select, configure, and …

Oct 13, 2025 · Monitoring With Zeek Detection and Response Workflow Instrumentation and Collection Storage and Review Zeek Log Formats and Inspection Working with a Sample Trace Zeek TSV …

Mar 23, 2020 · Corelight Sensors are built on Zeek (formerly called “Bro”), the open-source network security monitoring framework that generates actionable, real-time data for thousands of security …

Dec 7, 2018 · Overview Bro is a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity.