The Zeek Network Security Monitor

Our latest video is the first in a five part series about Hunting Threats with Zeek - check it out! Thank you to community member Raj for putting this series together 🙌 youtu.be/bl_VvR5LChE

We'll be at NSF Cybersecurity Summit tomorrow and NULLCON Berlin next week. Anyone going to either? www.trustedci.org/2026-nsf-cyb... nullcon.net/talk/meet-ze...

ICYMI: Community member Sujala used Zeek to monitor simulated readings from a biological incubator. It's not your typical Zeek use case 👀 zeek.org/2026/10/buil...

A missing package shouldn’t keep Zeek from starting. This month's Zeek Technique shares a built-in way to guard against that:

Steve Smoot joined last week's community call to talk about AI and Zeek in OT. Be sure to catch his talk here: youtu.be/3E1QM0QHKJw

Patch releases for Zeek 8.0 and 9.0 are expected around the end of the month. The team's also been spending time on security fixes for issues reported through LLM and AI tooling. Catch up on all Zeek updates in our latest newsletter:

Sujala pointed Zeek at a simulated biological incubator to see whether it could monitor sensor telemetry instead of network traffic. We found the project on GitHub and asked her to write about what she learned building it: zeek.org/2026/10/buil...

First-time contributor Van started the work on a DHCPv6 analyzer for Zeek that's now merged into master - and we're looking for feedback! Learn more in our latest newsletter:

Development on Zeek 9.1 is underway, and the September newsletter is out with the rest of this month's news: community.zeek.org/t/zeek-newsl...

Reminder for tomorrow's Community Call! Tune in live for project updates and a cool talk about AI and Zeek. zeek.org/events

Every default Zeek log exposes a hook you can use to veto individual log lines. Johanna shows how in her recent blog post:

Coming up at next Zeek Community Call: project updates, community news, and Zeek & AI. Tune in October 7 at 10am Pacific: zeek.org/events/

Renaming Zeek's JSON log fields to shorter names can save multiple gigabytes per day. Johanna shows how, plus how to use log filtering hooks to skip lines you don't need: zeek.org/2026/09/redu...

Evan demos experimental XDP support in Zeek: kernel-level traffic shunting that reduces processing overhead without specialized hardware. It’s experimental for now and feedback is welcome 😊 youtu.be/1B599l6lnWs

Fatema, Christian, and Aashish are leading a hands-on Zeek training at the NSF Cybersecurity Summit in October. Bring your laptop and leave with a running Zeek cluster. Registration closes October 9: www.trustedci.org/2026-nsf-cyb...

Next up in our Zeek 9 preview series: Christian Kreibich walks through the new Log Schema package. See how to document your log structures and track schema drift across different Zeek installations: youtu.be/GDuwUnz119U

We put together a few short demos to highlight what’s new in Zeek 9. Check out Arne's walkthrough of the new systemd generator, a modern alternative to zeekctl for managing Zeek on Linux systems: youtu.be/wzFAz1pYg9c

All recordings from Zeek Workshop Berkeley 2026 are now available! Check them out and stay tuned for news about future Zeek events... www.youtube.com/playlist?lis...

We're very, very excited to share that Zeek 9 has landed. Thank you to the contributors and community members who helped make this release happen! Read the full update on our blog: zeek.org/2026/09/intr...

If you missed out on Zeek Workshop Berkeley last week, we'll be uploading most of the talks here: www.youtube.com/playlist?lis... Keep an eye out as we continue sharing videos throughout the week.

We're always eager to share great content from our community members. Be sure to check out our monthly newsletter to get up to speed, and don't miss Aashish's and Arne's latest blog posts!

Berkeley is a blast 🤠

Zeek 9 RC2 is out for a few more days and we're looking for folks to test it. Details in the August newsletter: #Zeek #NetworkSecurity #OpenSource

Really looking forward to Aashish's talk on Thursday, where he's breaking down a year of LLM experiments at Berkeley Lab. Last call to join us: zeek.org/zeek-worksho...

This month's newsletter has a tip on a built-in function that generates an approximate object count for every global container variable, so you can spot the problem without guessing. Find it here! community.zeek.org/t/zeek-newsl... #Zeek #NetworkSecurity #OpenSource

We just published our monthly newsletter - catch up on development news, community happenings, and more: community.zeek.org/t/zeek-newsl...

Attacks rarely start with an exploit - they start with reconnaissance. In a new blog post, Aashish breaks down how scan detection works in Zeek, from tracking TCP failures with Simple Scan to using darknets and profile-based rules. zeek.org/2026/09/how-... #Zeek #NetworkSecurity

How does Lawrence Berkeley National Laboratory search through months of historical Zeek logs in seconds? We're excited to find out at next week's Zeek workshop in Berkeley. September 10-11. Free to attend: zeek.org/zeek-worksho...

At tomorrow's Community Call, we're talking all about Zeek 9. zeek.org/events/

How do we secure network monitors against emerging AI and quantum threats? Phuong Cao (NCSA) is joining us in Berkeley to share lessons from massive testbeds on bug-hunting with AI Agent Harness and analyzing cryptographic parsers. Join us Sept 10: zeek.org/zeek-worksho... #Zeek #NetworkSecurity

Some early takeaways from this year's community survey are now up on the blog - a big thank you to those who shared feedback with our team! zeek.org/2026/08/2026...

Next week's Community Call features a Zeek 9 preview from the open-source team, covering: + Log schemas + Running Zeek clusters with systemd + XDP packet shunting Join us live next Wednesday: zeek.org/events/ #Zeek #NetworkSecurity

Just over two weeks out from our workshop in Berkeley 👀 Registration is still open, grab your seat while you can: zeek.org/zeek-worksho... Thank you to our sponsor @corelight-inc.bsky.social for the suport!

Pushing high traffic volumes? Vern Paxson is going to break down new speed capabilities, scripting techniques, and implementation strategies to improve your network analysis performance. Join us in Berkeley next month to learn more! It's free to attend: zeek.org/zeek-worksho...

How are you currently managing Zeek processes? As we prepare for Zeek 9.0, we want to make sure the shift to native systemd aligns with how you run Zeek in production. Give this a read and let us know:

Curious about the Zeek roadmap? At the Berkeley workshop next month, Christian is presenting Zeek 9 and Beyond, covering the recent ZeroMQ cluster routing changes and what's next. Register for free here: zeek.org/zeek-worksho...

Monitoring a high-traffic Linux network? The updated zeek-xdp package is built to help Zeek process heavy traffic loads much more efficiently. Grab the package link in our latest newsletter:

When storing PCAPs is too costly, how do you debug false negatives in production? In Part 3 of his series, Yacin shows how to write a short driver script using the Input Framework to run and refine Zeek packages against months of historical log files. zeek.org/2026/07/the-...

Zeek 9.0 is just around the corner! Christian wrote a blog post that breaks down the feature roadmap, extensive LLM-driven security audits, and the upcoming release timeline. Give it a read: zeek.org/2026/08/zeek... #Zeek #OpenSource #NetworkSecurity #CyberSecurity

How do you defend one of the world's most hostile network environments? Join us in Berkeley next month, where Mark is going to explore how Zeek and Suricata are combined to hunt threats and secure Black Hat globally. zeek.org/zeek-worksho... #Zeek #OpenSource #NetworkSecurity #ThreatHunting

If you've ever had to manually convert raw Unix timestamps while sifting through JSON logs, a simple inline jq command handles it on the fly. Grab the snippet from our monthly Zeek Techniques spotlight in the latest newsletter:

In a new blog post, Arne breaks down how Zeek is shifting process management to native systemd and a new zeek.conf workflow for Zeek 9.0. If you run Zeek in production, read the rationale and share your feedback: zeek.org/2026/08/beyo... #Zeek #OpenSource #NetworkSecurity

We're one month out from Zeek Workshop Berkeley 2026 - don't forget to bring your laptop on Day 2 for training ⤵️ zeek.org/zeek-worksho...

What happens when you run extensive LLM security scanning and continuous fuzzing against the Zeek codebase? A massive batch of bug fixes heading into Zeek 9.0 rc1 and 8.0.10. Details on the mid-August release target in our latest newsletter:

Read our July community recap on debugging your mental model (and surviving 74,000 alerts in two hours): zeek.org/2026/08/the-... #Zeek #NetworkSecurity

Our latest newsletter is out 🗞️ community.zeek.org/t/zeek-newsl...

Evan's talk is going to be 🔥 🌶️ 🥵 zeek.org/zeek-worksho...

@dc510.bsky.social is this something your community would be interested in?

Reminder for tomorrow's community call - feel free to just tune in and listen: zeek.org/events/

If you're looking to bring up your first cluster or write custom event handlers, Day 2 of the Berkeley Workshop offers a full-day training track (Sept 11, 9 AM–3 PM). Know someone who should be in the room? Forward this along: zeek.org/zeek-worksho... #Zeek #NetworkSecurity