Check out our latest lightning talk! This team runs a weekly Zeek script that fires a test alert from tap to on-call notification. If it doesn't arrive, something's broken.
www.youtube.com/watch?v=zlA-...
Zeek 8.2 is in development! ZeroMQ performance is looking strong and the team is looking for feedback. Details in this month's newsletter 👇
Catch up on Zeek via our latest newsletter: 8.2 development, upcoming events, AI policy, and more: community.zeek.org/t/zeek-newsl...
A new blog post covers Zeek customization: what the community actually changes, what to leave alone, and why two people solving the same problem differently can both be right.
zeek.org/2026/03/what...
Don't forget about tomorrow's Community Call. Join us and let us know what's on your mind when it comes to Zeek.
Our recent blog post is worth a read if you've been thinking about Zeek + AWS:
Mark your calendars - the next Zeek Community Call is happening March 4 at 10am Pacific Time. Grab the Zoom link here:
zeek.org/events/
Talks on Zeek Intel Framework and Splunk for Zeek Data are happening at Part 2 of this Threat Intelligence Workshop series - happening tomorrow: indico.cern.ch/event/1596660/
New from the Zeek Team: Arne wrote about running Zeek with AWS Traffic Mirroring using the UDP packet source plugin. Read more on the blog: zeek.org/2026/02/usin...
Registration for our workshop closes March 9, but only a few spots are left. Grab yours and join us in Geneva before it's too late 👉 zeek.org/workshop-cer...
Check out a quick tip from this month's Zeek newsletter: a one-liner for processing multiple PCAPs at once using mergecap and Zeek together. Find it here: community.zeek.org/t/zeek-newsl...
What's the weirdest operational issue you've caught in your logs? We asked the Zeek community about things they've discovered - check out some of the stories on our blog:
Don't miss out on these upcoming events:
Leveraging MISP 📆 Feb 25
Zeek at CERN 📆 March 25-26
Trusted CI Training 📆 April 21
Details & RSVP community.zeek.org/t/zeek-newsl...
Follow Zeek releases with fewer issues with help from one of our recent blog posts: zeek.org/2026/02/why-...
Have you heard? JavaScript support is now available on Mac, enabling Mac users to experiment with Zeek scripting and JavaScript. Catch all the dev updates in our latest newsletter: community.zeek.org/t/zeek-newsl...
ICYMI: Evan's recent tutorial walks through Zeek scripting from the ground up. Types, events, functions, and a full detection example...
youtube.com/watch?v=nae8cdrUUKY
Newsletter's up - good stuff inside :)
community.zeek.org/t/zeek-newsl...
Sometimes what you find in Zeek logs isn't a security threat. It's operational problems - misconfigurations, chatty devices, applications doing strange things.
Our latest blog post highlights a few of these discovery stories from the community:
zeek.org/2026/02/how-...
The next Community Call is happening tomorrow - join us for project updates and more:
Upgrade Zeek without grief thanks to Benjamin's latest blog post: zeek.org/2026/02/why-...
Considering JA4? Take a look at Seth's recent blog post covering the full fingerprint family:
Our upcoming workshop at @cern.bsky.social will feature a Zeek 9.0 roadmap, CERN's network team on Zeek deployment, new storage framework, traffic shunting + full-day training on incident response and Spicy protocol analyzers.
Join us: zeek.org/workshop-cern-2026/schedule/
#Zeek #NetworkSecurity
The next Zeek Community Call is on the calendar for Wednesday February 4. Join us for project updates and more 👉 zeek.org/events/
Our new guide to JA4 network fingerprints in Zeek is up. Includes setup and real detection examples, check it out on our blog → zeek.org/2026/01/how-...
If you want the technical details on the new ZeroMQ backend architecture, setup, even performance monitoring, our recent video covers it all. Check it out below:
Zeek 8.1 cuts cluster CPU usage significantly with the new ZeroMQ backend. Head to our blog to learn why this architectural shift took years to ship, plus other updates in our latest release:
zeek.org/2026/01/intr...
The best Zeek stories come from users. This month our community is sharing recent discoveries - the weird, the threatening, and the unexpected.
Check out the newsletter to learn how you can share yours: community.zeek.org/t/zeek-newsl...
Check out our recent Zeek scripting tutorial that walks through the fundamentals of writing custom detections from basic types to building a working script.
If you've wanted to customize Zeek for your environment or write your own detections, this is a solid starting point:
youtu.be/nae8cdrUUKY
Zeek 8.1's big change: ZeroMQ as the default cluster backend. Arne's new video explains what that means and why it matters.
youtu.be/EeW_Oo-xNdQ
Zeek 8.1 is out now! What's inside? ZeroMQ cluster backend, JavaScript and WebSocket improvements, and much more.
community.zeek.org/t/zeek-featu...
