All recordings from Zeek Workshop Berkeley 2026 are now available! Check them out and stay tuned for news about future Zeek events...
Remote
The Zeek Network Security Monitor
@zeek@infosec.exchange
mastodon 4.8.0-alpha.3+glitchZeek is an open source network security monitor.
zeek.org | github.com/zeek | community.zeek.org
940 Followers
42 Following
37 Posts
Joined November 08, 2022
An attacker can hide an exploit in encrypted traffic, but they cannot hide that they had to look around your network first. In a new blog post, Aashish Sharma breaks down the mechanics of scan detection in Zeek.
https://zeek.org/2026/09/how-attackers-learn-your-network-before-they-attack-it/
Can LLMs help run Zeek in production?
Aashish is joining us at Zeek Workshop Berkeley to talk about real-world wins and failures from a year of using AI for incident response.
It's the final call to snag your seat: https://zeek.org/zeek-workshop-berkeley-2026/
#Zeek #NetworkSecurity
If your Zeek package relies on helper functions to process data before writing to a log, you don't need a PCAP to test that logic.
Part 1 of Yacin's new testing series demonstrates how to emulate unit testing frameworks inside BTest using Zeek 6.1's native assert statement.
Read the walkthrough: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-1/
#Zeek #NetworkSecurity #OpenSource #BTest
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek.
Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/
#NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
If you've wanted to learn Zeek scripting but didn't know where to start, Evan put together a comprehensive tutorial covering the basics through building a real detection.
Zeek Scripting Tutorial: Learn the Fundamentals
Practice is better than perfection - our recent blog post shares why:
ICYMI, we shared quite a few community updates in the latest newsletter, including a couple of pieces of community content.
Catch up on Zeek here:
In our latest Zeek 9 preview, Evan demos the experimental zeek-xdp package. XDP drops traffic at the kernel level before it reaches Zeek's analysis pipeline, reducing overhead without expensive hardware.
Still experimental, and Evan is actively looking for community feedback. Let us know what you think!
Looking forward to this Zeek 9 preview at tomorrow's Community Call :blobderpy:
Join us next week for the September Community Call for a preview of Zeek 9 with our dev team:
+ Christian - Log schemas
+ Arne - Running Zeek clusters with systemd
+ Evan - XDP packet shunting
Bring your questions for the Q&A. Find the Zoom link here: https://zeek.org/events/
We're excited to share our updated Contribution Guide, inspired by recent feedback from the Zeek community.
Our goal is to make it easier to contribute to the project. Learn more:
https://zeek.org/2026/07/weve-updated-the-zeek-contribution-guide/
RE: https://infosec.exchange/@zeek/117032972009131346
We'll be sharing the latest Zeek project news at 10am Pacific tomorrow. Tune in to learn what we've been working on: https://zeek.org/events/
Quoting
This Wednesday we'll be meeting on Zoom for our monthly Community Call. Link to join can be found here: https://zeek.org/events/
RE: https://infosec.exchange/@zeek/116919245094511768
Spicy makes writing Zeek parsers safe and easy, but legacy Binpac has historically held the crown for raw speed. Can the latest Spicy optimizations actually close that gap under a real production load?
We skipped the sterile microbenchmarks and put them to the test against real-world network traffic. Read the full performance breakdown:
Quoting
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2.
The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too.
https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/
#Zeek #NetworkSecurity #OpenSource #Spicy
When PCAPs aren't available, can't be shared, or your script depends on external services, standard BTests need a different approach.
Part 2 of Yacin's testing series walks through hand-crafting events and using Zeek's built-in event tracing flag.
Read Part 2: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-2/
#Zeek #NetworkSecurity #BTest #OpenSource
What's new with us? Find out in our latest newsletter: https://community.zeek.org/t/zeek-newsletter-issue-65-july-2026/8013
We pulled together some initial reactions to this year's community survey results - we appreciate every piece of feedback we received and we're looking forward to digging deeper:
https://zeek.org/2026/08/2026-zeek-project-survey-results-what-we-heard-and-whats-next/
Zeek 9 RC2 is out and the team is looking for people to test it!
Details in the August newsletter:
If you missed out on Zeek Workshop Berkeley last week, we'll be uploading most of the talks here: https://www.youtube.com/playlist?list=PLc8cHxXjwImA
Keep an eye out as we continue sharing videos throughout the week.
RE: https://infosec.exchange/@zeek/116874651875783351
If you're still manually piecing together separate MIME attachments or body segments during email analysis, you're doing unnecessary work.
Zeek has a built-in event that automatically combines it all into a single, cohesive string: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006#p-29791-zeek-techniques-5
#Zeek #NetworkSecurity #EmailSecurity
How do we secure network monitors against emerging AI and quantum threats?
Phuong Cao (NCSA) is joining us in Berkeley to share lessons from massive testbeds on bug-hunting with AI Agent Harness and analyzing cryptographic parsers.
Save your seat: https://zeek.org/zeek-workshop-berkeley-2026/
We've got a hands-on Zeek training coming up at the NSF Cybersecurity Summit on October 27 in Irvine, CA. Bring your laptop and work through real-world R&E deployment models, cluster setup, the management framework, package manager, and a session on Unicor for threat hunting.
Registration closes October 9.
https://www.trustedci.org/2026-nsf-cybersecurity-summit
We launched a new Contribution Guide earlier this month to fix the biggest hurdle from last year's community survey: "I don't know where to start."
What should we fix next? Tell us in the 2026 survey (open until August 14):
zeek.org/survey
#Zeek #OpenSource #NetworkSecurity
RE: https://infosec.exchange/@zeek/116925801508243282
Have you marked your calendar yet? Join us in Berkeley September 10 & 11:
https://zeek.org/zeek-workshop-berkeley-2026/registration-berkeley/
Quoting
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek.
Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/
#NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
Our annual community survey is open through August 14. It's short, anonymous, and worth knowing about if you're using Zeek!
Other community updates in our newsletter: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1
Survey here: https://zeek.org/survey
This month's newsletter has a tip on a built-in function that generates an approximate object count for every global container variable, so you can spot the problem without guessing.
Find it here! https://community.zeek.org/t/zeek-newsletter-issue-66-august-2026/8068/1
We’ve put together a few video demos to walk through what's landing in Zeek 9. Check out Arne's demo on the new systemd generator to see how it replaces zeekctl for managing Zeek on Linux:
https://youtu.be/wzFAz1pYg9c
Managing a Zeek Cluster with systemd
This Wednesday we'll be meeting on Zoom for our monthly Community Call. Link to join can be found here: https://zeek.org/events/
Another Zeek 9 preview demo is live! Check out Christian's walkthrough of the new Log Schema package: https://youtu.be/GDuwUnz119U
New from Johanna: two ways to shrink Zeek's JSON logs, inspired by a community member who found it saved him multiple gigabytes a day:
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2.
The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too.
https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/
#Zeek #NetworkSecurity #OpenSource #Spicy
RE: https://infosec.exchange/@zeek/116852154229547483
Want to expand what your Zeek deployment can see and do?
Two new community-contributed packages just joined the Zeek ecosystem, tackling two very different operational challenges.
Get the full details and installation commands in our June newsletter:
We just published our monthly newsletter - catch up on development news, community happenings, and more:
https://community.zeek.org/t/zeek-newsletter-issue-66-august-2026/8068/1
RE: https://infosec.exchange/@zeek/116879590940339962
Where does Sigma matching belong in your network security stack? It's a critical architectural question when deciding exactly where detection logic should live.
Revisit our recent community discussion exploring what actually catches threats in a Zeek deployment:
We're in Berkeley!
We're very, very excited to share that Zeek 9 has landed. Thank you to the contributors and community members who helped make this release happen!
Read the full update on our blog: https://zeek.org/2026/09/introducing-zeek-9/
How does Lawrence Berkeley National Laboratory search through months of historical Zeek logs in seconds? We're excited to find out at next week's Zeek workshop in Berkeley.
September 10-11. Free to attend: https://zeek.org/zeek-workshop-berkeley-2026/