Zeek
Zeek is an improved framework for network traffic analysis and security monitoring. It includes protocol analyzers capable of in-depth semantic analysis in the application layer, and allows for the implementation of institution-specific monitoring policies thanks to its unique scripting language. It is designed to run on high-performance networks, and archives application layer states on the network in detail.
Zeek
100zeek · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You perform detailed traffic analysis by resolving network protocols in the application layer.
- By writing your own scripts, you customize network monitoring policies to their needs.
- In high-performance networks, you archive network activities by tracking application layer states.
- ↑ PositiveHacker News
Zeek is now a component of Microsoft Windows
“I think the real issue here is that things like Snort, Suricata, and Zeek are just not very popular as a class of security thingy anymore. Certainly, for the last 10 years or so, I'd have advised most startups I worked with against deploying anything like them. There was, in the…”
- ↓ NegativeHacker News
Zeek is now a component of Microsoft Windows
“> Corelight, the leader in open network detection and response (NDR), today announced the integration of Zeek®, the world’s most popular open source network security monitoring platform,... How not to write an opener of your press release. From "the leader", to (r), to "world's…”