Repository files navigation

• In-depth AnalysisZeek ships with analyzers for many protocols, enabling high-level semanticanalysis at the application layer.

• Adaptable and FlexibleZeek's domain-specific scripting language enables site-specific monitoringpolicies and means that it is not restricted to any particular detectionapproach.

• EfficientZeek targets high-performance networks and is used operationally at a varietyof large sites.

• Highly StatefulZeek keeps extensive application-layer state about the network it monitorsand provides a high-level archive of a network's activity.

The best place to find information about getting started with Zeek isour web sitewww.zeek.org, specifically thedocumentation sectionthere. On the web site you can also find downloads for stablereleases, tutorials on getting Zeek set up, and many other usefulresources.

You can find release notes inNEWS,and a complete record of all changes inCHANGES.

To work with the most recent code from the development branch of Zeek,clone the master git repository:

git clone --recursive https://github.com/zeek/zeek

With alldependenciesin place, build and install:

./configure && make && sudo make install

Write your first Zeek script:

# File "hello.zeek"eventzeek_init()    {print"Hello World!";    }

And run it:

zeek hello.zeek

For learning more about the Zeek scriptinglanguage,try.zeek.org is a great resource.

Zeek is developed on GitHub by its community. We welcomecontributions. Working on an open source project like Zeek can be anincredibly rewarding experience and, packet by packet, makes theInternet a little safer. Today, as a result of countlesscontributions, Zeek is used operationally around the world by majorcompanies and educational and scientific institutions alike forsecuring their cyber infrastructure.

If you're interested in getting involved, we collect feature requestsand issues on GitHubhere andyou might findtheseto be a good place to get started. More information on Zeek'sdevelopment can be foundhere, and informationabout its community and mailing lists (which are fairly active) can befoundhere.

Zeek comes with a BSD license, allowing for free use with virtually norestrictions. You can find ithere.

We use the following tooling to help discover issues to fix, amongst a number ofothers.

• Clang-Tidy
• Coverity
• PVS-Studio - static analyzer for C, C++, C#, and Java code.