Zeek is a powerful system that on top of the functionality it provides out of the box, also offers the flexibility to customize analysis pretty much arbitrarily. We provide a range of documentation material ranging from introductory material to get you started, to full references of Zeek’s various frameworks.
Documentation
- Frequently Asked Questions
- The Zeek FAQ, covering common questions about Zeek and the Zeek Project.
Zeek Manual (release) (git/master)
Previous Zeek/Bro Manual Versions
Tutorials, Slides, Exercises and More
We are maintaining a growing collection of slides, videos, exercises, and other materials the members of the Zeek Project have created over time. Please note some of the older material may not directly apply in all specifics to newer Zeek versions.
- How to Zeek: Tutorials
- Interactive tutorials based on try.zeek.org. This new tool allows you to follow guided exercises and tutorials that you can try out directly while reading. Additionally you can find less interactive older tutorials on this page.
- Slides
- Slide sets used for event talks and trainings.
- Videos
- YouTube: Zeek Project
- Video tutorials, past events hosted by Zeek, talks from members of the Zeek community, and screencasts.
- The More You Zeek
- A web series demonstrating various features and uses of Zeek.
- Zeek Teaching and Training
- Use Zeek’s tools and toys to play with Zeek or let others play without harming your live system. This is the place for teachers, trainers, self educators, and playful Zeek users.
- Exercises
- A collection of training exercises.
The Zeek Blog
The Zeek Blog is probably the most current source for latest news and announcements about the Zeek Project. Here is where we inform about scripts reacting on current security breaches we, little and big pieces of helpful Zeek knowledge for your everyday Zeek practice.
Third Party Blogs about Zeek
- Learning Bro Scripting - Part 1, Part 2, Part 3
- Series of blog postings by Scott Runnels on writing Bro scripts. (April - May 2012)
- Anthony Kasza’s Brolog
- Stories from the daily life with Bro, Bro teaching, and an extensive resource of knowledge.
Zeek Above and Beyond: Traces, Software, Docs, …
- Overview of the Bro Intrusion Detection System
- An introductory webinar presented by Nick Buraglio of the Energy Sciences Network (ESnet). Recorded May 22nd, 2015.
- 100G Intrusion Detection
- A comprehensive technical document for setting up a Zeek installation on a 100G network. Written by the Berkeley Lab Cyber Security Team.
- Packet Traces
- A collection of publicly available packet traces for experimentation and training.
- Related Software
- A collection of external software provided by the larger Zeek community.
Page Contents
Quick Links
- 13 February 2020: Ask the Zeeksperts - Aashish Sharma
- 18 February 2020 - Portland OR: Zeek Days Workshops
- 27 February 2020: Ask the Zeeksperts
- 7-9 October 2020 - Austin, Texas: ZeekWeek 2020
