Zeek

A powerful framework for network traffic analysis and security monitoring.

Key Features

• In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer.

• Adaptable and Flexible Zeek's domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach.

• Efficient Zeek targets high-performance networks and is used operationally at a variety of large sites.

• Highly Stateful Zeek keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network's activity.