Elektrine
Log in Register

#zeek

10 posts · Last used Sep 09

The Zeek Network Security Monitor @zeek@infosec.exchange
· 1mo ago
Can LLMs help run Zeek in production? Aashish is joining us at Zeek Workshop Berkeley to talk about real-world wins and failures from a year of using AI for incident response. It's the final call to snag your seat: https://zeek.org/zeek-workshop-berkeley-2026/ #Zeek #NetworkSecurity
zeek.org

Workshop Home – Zeek Network Security Monitor

Zeek Workshop, Berkeley, September 10-11, 2026: two days of technical talks and hands-on training with the Zeek team and community. Free to attend.

1
0
0
0
The Zeek Network Security Monitor @zeek@infosec.exchange
· 2mo ago
When PCAPs aren't available, can't be shared, or your script depends on external services, standard BTests need a different approach. Part 2 of Yacin's testing series walks through hand-crafting events and using Zeek's built-in event tracing flag. Read Part 2: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-2/ #Zeek #NetworkSecurity #BTest #OpenSource
zeek.org

The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor

This is Part 2 of a three-part series. Read Part 1 and Part 3. Introduction In the previous part of this blog series, we presented our motivational package, ip-distance, and how you can easily write unit tests in BTest. This works great for smaller auxiliary functions that aren't necessarily driven by network traffic, but what…

0
0
0
0
Seth Grover @mmguero@infosec.exchange
· 2mo ago
If you use #Zeek at all, please go take the 2026 project survey. #PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #CyberSecurity #Cyber #Infosec
Google Docs

Zeek Project Survey 2026

Thanks for taking this survey! We're eager to catch up on your experience with Zeek. We've designed this to take 10-15 minutes and responses are anonymous. We'll use this feedback to understand what the community needs most and decide what to prioritize for the rest of the year.

0
0
0
0
The Zeek Network Security Monitor @zeek@infosec.exchange
· 2mo ago
If your Zeek package relies on helper functions to process data before writing to a log, you don't need a PCAP to test that logic. Part 1 of Yacin's new testing series demonstrates how to emulate unit testing frameworks inside BTest using Zeek 6.1's native assert statement. Read the walkthrough: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-1/ #Zeek #NetworkSecurity #OpenSource #BTest
zeek.org

The Cure for Exceptional Zeek Package Testing (Part 1) – Zeek Network Security Monitor

This is Part 1 of a three-part series. Read Part 2 and Part 3. Introduction As someone who ships a lot of Zeek packages to production, I'm always looking for ways to improve package testing. In the common, simple case, you have a small PCAP that exercises the behavior you need to generate your log…

1
0
0
0
Seth Grover @mmguero@infosec.exchange
· 2mo ago
release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
1
0
3
0
Ken @zorg_the_blue@infosec.exchange
· 2mo ago
Any Zeek enthusiasts who have experience or guidance for installing Zeek in Azure to monitor traffic to hosted services (app gateway to private endpoints)? Azure TAP/SPAN features totally suck, they have failed to get this right 10 years on. Looking to see if there is a way someone has figured out that doesn't involve crazy load balancing architectures with VMs simply for the purpose of a a NIC to tap. Thanks! #zeek
0
0
1
0
The Zeek Network Security Monitor @zeek@infosec.exchange
· 2mo ago
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek. Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/ #NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
zeek.org

Schedule – Zeek Network Security Monitor

ScheduleWorkshop Schedule Talks and trainings will not be recorded, but we will share presentation materials after the event. Schedule coming soon.

1
0
0
2
The Zeek Network Security Monitor @zeek@infosec.exchange
· 2mo ago
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2. The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too. https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/ #Zeek #NetworkSecurity #OpenSource #Spicy
zeek.org

Spicy vs. Binpac Performance, One Year Later – Zeek Network Security Monitor

One year has passed since I last wrote about Spicy’s performance (you can read about that here). In that post, I compared it to Binpac. This will be a simple followup: how much progress have we made? How much would this translate to real analyzers? I won’t bury the lede. This table shows the Binpac…

0
0
0
1
The Zeek Network Security Monitor @zeek@infosec.exchange
· 2mo ago
RE: https://infosec.exchange/@zeek/116874651875783351 If you're still manually piecing together separate MIME attachments or body segments during email analysis, you're doing unnecessary work. Zeek has a built-in event that automatically combines it all into a single, cohesive string: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006#p-29791-zeek-techniques-5 #Zeek #NetworkSecurity #EmailSecurity
community.zeek.org
0
1
0
0
You've seen all posts