Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
https://github.com/zeek/zeek

bro dfir network-monitoring nsm pcap security zeek

Last synced: 5 days ago
JSON representation

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Awesome Lists containing this project

README 

        
=================================

The Zeek Network Security Monitor

=================================



Zeek is a powerful framework for network traffic analysis and security

monitoring. Follow us on Twitter at @zeekurity.



Key Features

============



*   **In-depth Analysis**

    Zeek ships with analyzers for many protocols, enabling

    high-level semantic analysis at the application layer.



*   **Adaptable & Flexible**

    Zeek's domain specific scripting language enables site-specific

    monitoring policies and means that it is not restricted to any

    particular detection approach.



*   **Efficient**

    Zeek targets high-performance networks and is used operationally

    at a variety of large sites.



*   **Highly Stateful**

    Zeek keeps extensive application-layer state about the network

    it monitors and provides a high-level archive of a network's

    activity.



Getting Started

===============



The best place to find information about getting started with Zeek is

our web site https://www.zeek.org, specifically the documentation

section there [1]. One the web site you can also get downloads for

stable releases, tutorials on getting Zeek set up, and many other

useful resources.



You can find release notes in NEWS, and a complete record of all

changes in CHANGES.



To work with the most recent code from the development branch of Zeek,

clone the master git repository:



    > git clone --recursive https://github.com/zeek/zeek



With all dependencies [2] in place, build and install:



    > ./configure && make && sudo make install



Write your first Zeek script:



    # File "hello.zeek"



    event zeek_init()

        {

        print "Hello, World!";

        }



And run it:



    > zeek hello.zeek



For learning more about the Zeek scripting language,

https://try.zeek.org is a great resource.



Development

===========



Zeek is developed on GitHub by its community. We welcome

contributions. Working on an open source project like Zeek can be an

incredibly rewarding experience and, packet by packet, makes the

Internet a little safer. Today, as a result of countless

contributions, Zeek is used operationally around the world by major

companies and educational and scientific institutions alike for

securing their cyber infrastructure.



If you're interested in getting involved, we collect feature requests

and issues on GitHub. More information on Zeek's development can be

found here [2], and information about its community and mailing lists

(which are fairly active) can be found here [3].



License

-------



Zeek comes with a BSD license, allowing for free use with virtually no

restrictions. You can find it in COPYING.



Tooling

-------



We use the following tooling to help discover issues to fix, amongst a number of

others.



- Clang-Tidy [5]

- Coverity [6]

- PVS-Studio - static analyzer for C, C++, C#, and Java code [7]



[1] https://www.zeek.org/documentation/index.html

[2] https://docs.zeek.org/en/stable/install/install.html

[3] https://www.zeek.org/development/index.html

[4] https://www.zeek.org/community/index.html

[5] https://clang.llvm.org/extra/clang-tidy/

[6] https://scan.coverity.com/projects/bro

[7] https://pvs-studio.com/en/pvs-studio/?utm_source=github&utm_medium=organic&utm_campaign=open_source