All recordings from Zeek Workshop Berkeley 2026 are now available! Check them out and stay tuned for news about future Zeek events...
Remote
The Zeek Network Security Monitor
@zeek@infosec.exchange
mastodon 4.8.0-alpha.3+glitchZeek is an open source network security monitor.
zeek.org | github.com/zeek | community.zeek.org
940 Followers
42 Following
40 Posts
Joined November 08, 2022
An attacker can hide an exploit in encrypted traffic, but they cannot hide that they had to look around your network first. In a new blog post, Aashish Sharma breaks down the mechanics of scan detection in Zeek.
https://zeek.org/2026/09/how-attackers-learn-your-network-before-they-attack-it/
Can LLMs help run Zeek in production?
Aashish is joining us at Zeek Workshop Berkeley to talk about real-world wins and failures from a year of using AI for incident response.
It's the final call to snag your seat: https://zeek.org/zeek-workshop-berkeley-2026/
#Zeek #NetworkSecurity
RE: https://infosec.exchange/@zeek/116874651875783351
If you're still manually piecing together separate MIME attachments or body segments during email analysis, you're doing unnecessary work.
Zeek has a built-in event that automatically combines it all into a single, cohesive string: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006#p-29791-zeek-techniques-5
#Zeek #NetworkSecurity #EmailSecurity
Quoting
RE: https://infosec.exchange/@zeek/116852154229547483
We shared a cool first-time contributor story in our newsletter this month - check out the dev update to learn about how they extended the LDAP analyzer to forward NTLM and Kerberos authentication data to their respective analyzers:
Open quoted post
If your Zeek package relies on helper functions to process data before writing to a log, you don't need a PCAP to test that logic.
Part 1 of Yacin's new testing series demonstrates how to emulate unit testing frameworks inside BTest using Zeek 6.1's native assert statement.
Read the walkthrough: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-1/
#Zeek #NetworkSecurity #OpenSource #BTest
We launched a new Contribution Guide earlier this month to fix the biggest hurdle from last year's community survey: "I don't know where to start."
What should we fix next? Tell us in the 2026 survey (open until August 14):
zeek.org/survey
#Zeek #OpenSource #NetworkSecurity
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek.
Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/
#NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
In last month's community discussion, we learned how practitioners are building detection from their own historical data:
https://zeek.org/2026/07/what-actually-catches-threats-in-a-zeek-deployment/
#Zeek #NetworkSecurity #OpenSource
If you've wanted to learn Zeek scripting but didn't know where to start, Evan put together a comprehensive tutorial covering the basics through building a real detection.
Zeek Scripting Tutorial: Learn the Fundamentals
RE: https://infosec.exchange/@zeek/116257601750396280
Practice is better than perfection - our recent blog post shares why:
RE: https://infosec.exchange/@zeek/117032972009131346
We'll be sharing the latest Zeek project news at 10am Pacific tomorrow. Tune in to learn what we've been working on: https://zeek.org/events/
Quoting
This Wednesday we'll be meeting on Zoom for our monthly Community Call. Link to join can be found here: https://zeek.org/events/
In our latest Zeek 9 preview, Evan demos the experimental zeek-xdp package. XDP drops traffic at the kernel level before it reaches Zeek's analysis pipeline, reducing overhead without expensive hardware.
Still experimental, and Evan is actively looking for community feedback. Let us know what you think!
Experimental XDP Support in Zeek: Kernel-Level Traffic Shunting Demo
This Wednesday we'll be meeting on Zoom for our monthly Community Call. Link to join can be found here: https://zeek.org/events/
How do we secure network monitors against emerging AI and quantum threats?
Phuong Cao (NCSA) is joining us in Berkeley to share lessons from massive testbeds on bug-hunting with AI Agent Harness and analyzing cryptographic parsers.
Save your seat: https://zeek.org/zeek-workshop-berkeley-2026/
Join us next week for the September Community Call for a preview of Zeek 9 with our dev team:
+ Christian - Log schemas
+ Arne - Running Zeek clusters with systemd
+ Evan - XDP packet shunting
Bring your questions for the Q&A. Find the Zoom link here: https://zeek.org/events/
Another Zeek 9 preview demo is live! Check out Christian's walkthrough of the new Log Schema package: https://youtu.be/GDuwUnz119U
Introducing Log Schema for Zeek: Know What Your Logs Actually Look Like
RE: https://infosec.exchange/@zeek/116852154229547483
Want to expand what your Zeek deployment can see and do?
Two new community-contributed packages just joined the Zeek ecosystem, tackling two very different operational challenges.
Get the full details and installation commands in our June newsletter:
Quoting
Catch up on Zeek development, community news, and more in our latest newsletter - out now: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1
We pulled together some initial reactions to this year's community survey results - we appreciate every piece of feedback we received and we're looking forward to digging deeper:
https://zeek.org/2026/08/2026-zeek-project-survey-results-what-we-heard-and-whats-next/
We're very, very excited to share that Zeek 9 has landed. Thank you to the contributors and community members who helped make this release happen!
Read the full update on our blog: https://zeek.org/2026/09/introducing-zeek-9/
What's new with us? Find out in our latest newsletter: https://community.zeek.org/t/zeek-newsletter-issue-65-july-2026/8013
We’ve put together a few video demos to walk through what's landing in Zeek 9. Check out Arne's demo on the new systemd generator to see how it replaces zeekctl for managing Zeek on Linux:
https://youtu.be/wzFAz1pYg9c
Managing a Zeek Cluster with systemd
Catch up on Zeek development, community news, and more in our latest newsletter - out now: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1
RE: https://infosec.exchange/@zeek/117163417116173643
Looking forward to this Zeek 9 preview at tomorrow's Community Call :blobderpy:
RE: https://infosec.exchange/@zeek/116879590940339962
Where does Sigma matching belong in your network security stack? It's a critical architectural question when deciding exactly where detection logic should live.
Revisit our recent community discussion exploring what actually catches threats in a Zeek deployment:
Quoting
In last month's community discussion, we learned how practitioners are building detection from their own historical data:
https://zeek.org/2026/07/what-actually-catches-threats-in-a-zeek-deployment/
#Zeek #NetworkSecurity #OpenSource
We've got a hands-on Zeek training coming up at the NSF Cybersecurity Summit on October 27 in Irvine, CA. Bring your laptop and work through real-world R&E deployment models, cluster setup, the management framework, package manager, and a session on Unicor for threat hunting.
Registration closes October 9.
https://www.trustedci.org/2026-nsf-cybersecurity-summit
RE: https://infosec.exchange/@zeek/116852154229547483
We shared a cool first-time contributor story in our newsletter this month - check out the dev update to learn about how they extended the LDAP analyzer to forward NTLM and Kerberos authentication data to their respective analyzers:
Quoting
Catch up on Zeek development, community news, and more in our latest newsletter - out now: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1
New from Johanna: two ways to shrink Zeek's JSON logs, inspired by a community member who found it saved him multiple gigabytes a day:
RE: https://infosec.exchange/@zeek/117208951284235542
ICYMI, we shared quite a few community updates in the latest newsletter, including a couple of pieces of community content.
Catch up on Zeek here:
When PCAPs aren't available, can't be shared, or your script depends on external services, standard BTests need a different approach.
Part 2 of Yacin's testing series walks through hand-crafting events and using Zeek's built-in event tracing flag.
Read Part 2: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-2/
#Zeek #NetworkSecurity #BTest #OpenSource
If you missed out on Zeek Workshop Berkeley last week, we'll be uploading most of the talks here: https://www.youtube.com/playlist?list=PLc8cHxXjwImA
Keep an eye out as we continue sharing videos throughout the week.
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2.
The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too.
https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/
#Zeek #NetworkSecurity #OpenSource #Spicy
How does Lawrence Berkeley National Laboratory search through months of historical Zeek logs in seconds? We're excited to find out at next week's Zeek workshop in Berkeley.
September 10-11. Free to attend: https://zeek.org/zeek-workshop-berkeley-2026/
RE: https://infosec.exchange/@zeek/116919245094511768
Spicy makes writing Zeek parsers safe and easy, but legacy Binpac has historically held the crown for raw speed. Can the latest Spicy optimizations actually close that gap under a real production load?
We skipped the sterile microbenchmarks and put them to the test against real-world network traffic. Read the full performance breakdown:
Quoting
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2.
The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too.
https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/
#Zeek #NetworkSecurity #OpenSource #Spicy
We're excited to share our updated Contribution Guide, inspired by recent feedback from the Zeek community.
Our goal is to make it easier to contribute to the project. Learn more:
https://zeek.org/2026/07/weve-updated-the-zeek-contribution-guide/
We're in Berkeley!
We just published our monthly newsletter - catch up on development news, community happenings, and more:
https://community.zeek.org/t/zeek-newsletter-issue-66-august-2026/8068/1
RE: https://infosec.exchange/@zeek/117236416903002157
Zeek 9 RC2 is out and the team is looking for people to test it!
Details in the August newsletter:
This month's newsletter has a tip on a built-in function that generates an approximate object count for every global container variable, so you can spot the problem without guessing.
Find it here! https://community.zeek.org/t/zeek-newsletter-issue-66-august-2026/8068/1
RE: https://infosec.exchange/@zeek/116925801508243282
Have you marked your calendar yet? Join us in Berkeley September 10 & 11:
https://zeek.org/zeek-workshop-berkeley-2026/registration-berkeley/
Quoting
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek.
Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/
#NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
Our annual community survey is open through August 14. It's short, anonymous, and worth knowing about if you're using Zeek!
Other community updates in our newsletter: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1
Survey here: https://zeek.org/survey