Learn about Zeek, the open-source network security monitoring framework formerly known as Bro, including its features, licensing, and use cases.
Zeek is an open-source network security monitoring framework originally created by Vern Paxson, who began development in 1995 at Lawrence Berkeley National Laboratory under the name Bro, a reference to Big Brother from George Orwell's Nineteen Eighty-Four. Paxson's original 1998 paper on the system won the USENIX Security Symposium's Best Paper Award.
In late 2018, the project was renamed from Bro to Zeek, inspired by the pseudo-username zeek that Berkeley Lab developers had used to run their network sensors in the 1990s, and intended to better reflect the values of the project's growing community.
Zeek is not a company but a community-stewarded open-source project, distributed under a permissive BSD license, historically hosted at the nonprofit International Computer Science Institute (ICSI) and today financially supported and championed by Corelight, a commercial security company co-founded by Paxson.
Unlike signature-based intrusion detection tools, Zeek focuses on deep protocol analysis across dozens of network protocols, producing compact, structured, high-fidelity logs of network activity rather than primarily generating alerts.
Zeek includes its own domain-specific scripting language, letting security analysts write custom detection and analysis logic tailored to their environment, and supports an extensive plugin and package ecosystem through the Zeek Package Manager.
For high-throughput networks, Zeek supports cluster deployments that distribute traffic analysis across multiple worker processes, and its logs are commonly fed into SIEMs and threat-hunting platforms for investigation.
Zeek is completely free and open source under a permissive BSD license, with no paid edition or feature-gated tier.
There is no official vendor support included with the open-source project itself; organizations wanting commercial support or a more turnkey product typically look to Corelight, which builds a commercial platform on top of Zeek.
Because Zeek requires self-hosting and tuning, its real cost for most organizations lies in the infrastructure and security engineering expertise needed to deploy and operate it effectively, rather than in a license fee.
Zeek focuses on deep, structured logging of network activity for analysis, while tools like Snort and Suricata are primarily signature-based intrusion detection systems focused on alerts.
Yes, the project was named Bro from its creation in the 1990s until it was renamed Zeek in late 2018.
Yes, Zeek is completely free and open source under a permissive BSD license.
Zeek primarily generates detailed structured logs of network activity; alerting and correlation are typically handled by a downstream SIEM or custom Zeek scripts.
It is a tool for installing and managing community-built plugins and packages that extend Zeek's functionality.
Yes, Zeek supports cluster deployments that distribute analysis across multiple worker processes for high-throughput environments.
Zeek is a community-stewarded open-source project that receives significant financial and technical support from Corelight.
Zeek can extract useful metadata and behavioral signals from encrypted traffic even when it cannot decrypt the payload.