Why Choose Zeek? Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. (Zeek is the new name for the long-established Bro system. Note that parts of the system retain the "Bro" name, and it also often appears in the documentation and distributions.)
-
Adaptable
Zeek's domain-specific scripting language enables site-specific monitoring policies.
-
Efficient
Zeek targets high-performance networks and is used operationally at a variety of large sites.
-
Flexible
Zeek is not restricted to any particular detection approach and does not rely on traditional signatures.
-
Forensics
Zeek comprehensively logs what it sees and provides a high-level archive of a network's activity.
-
In-depth Analysis
Zeek comes with analyzers for many protocols, enabling high-level semantic analysis at the application layer.
-
Highly Stateful
Zeek keeps extensive application-layer state about the network it monitors.
-
Open Interfaces
Zeek interfaces with other applications for real-time exchange of information.
-
Open Source
Zeek comes with a BSD license, allowing for free use with virtually no restrictions.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Major Supporters
