Community Resources

Mailing List

The best place ask questions is the Zeek user mailing list. Feel free to ask for help, post your thoughts on Zeek, and announce related work and projects that may be of interest to other Zeek users. Access the mailing list’s archive here.

Announcement Mailing List

Subscribe to our annoucement mailing list to get information about new Zeek versions, as well as about security issues affecting Zeek. This is a moderated low volume list with just a few posts per year. Posts to the announcement mailing list are also posted to the general Zeek mailing list - there is no need to subscribe to both of them.

Twitter

Follow our Twitter account @zeekurity to stay up to date with recent developments. When tweeting about Zeek, make sure to include @zeekurity so that we see it; we are happy to retweet Zeek-related news from users and organizations.

As a general rule, if a Tweet originates from @zeekurity, it represents the voice of the project. When we retweet, however, we do so without judgement; @zeekurity does not endorse external organizations or content.

IRC

A number of Zeek folks tend to hang out on Freenode‘s IRC #bro channel. You are welcome to join and ask questions.

Zeek Teaching and Training

Use Zeek’s tools and toys to play with Zeek or let others play without harming your live system. This is the place for teachers, trainers, self educators, and playful Zeek users.

Zeek Workshops and Events

We regularly hold Zeek Workshops and post details about Zeek talks and trainings to bring the Zeek community together.

Videos

Bro Project

Past events hosted by Zeek/Bro, talks from members of the Zeek community, and screencasts.

The More You Bro

A web series demonstrating various features and uses of Zeek/Bro.

Contributing to the Zeek Project

There are many different ways to give back to the Zeek Project. Below are a few suggestions.

Custom Scripts and/or Plugins

We encourage Zeek users to make their custom scripts and/or plugins available to the community by creating a package and submitting it to the Zeek Package Source. See the README file of that GitHub repo for more instructions on how to create a package and submit it. Once your package is accepted, it becomes installable via the Zeek Package Manager. One may also find it easier to browse and search through the community-maintained packages via the Zeek Package Browser (packages.zeek.org).

Patches and New Functionality

For working on the Zeek codebase itself, work from our official GitHub repository. See our contribution guidelines for more information.

Writing Documentation

We are grateful for any corrections or contributions to documentation. Send documentation to info@zeek.org or submit a ticket to our issue tracker.

Provide community support

Respond to user questions on the Mailing List, Twitter, and IRC.

Additional Resources

Bro Log Cheat Sheets

Common Zeek/Bro logs in cheat sheet form. This document was provided by Corelight, Inc.

Related Software

A collection of external software provided by the larger Zeek community.

Packet Traces

A collection of publicly available packet traces for experimentation and training.

100G Intrusion Detection

A comprehensive technical document for setting up a Zeek installation on a 100G network. Written by the Berkeley Lab Cyber Security Team.

Why Choose Zeek?

A promotional document highlighting some of Zeek’s features and applications. A corresponding video of this content has been added to our YouTube channel.

Overview of the Bro Intrusion Detection System

An introductory webinar presented by Nick Buraglio of the Energy Sciences Network (ESnet). Recorded May 22nd, 2015.

Corelight Elastic Common Schema Mapping

Elastic Common Schema that connects Zeek data types to relevant ECS field names.