Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Key Features
- In-depth Analysis it ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer.
- Adaptable and Flexible it’s domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach.
- Efficient it targets high-performance networks and is used operationally at a variety of large sites.
- Highly Stateful it keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network’s activity.
Also Read – Userrecon-py : Username Recognition On Various Websites
The best place to find information about getting started with it is our web site www.zeek.org, specifically the documentation section there. On the web site you can also find downloads for stable releases, tutorials on getting it set up, and many other useful resources.
You can find release notes in NEWS, and a complete record of all changes in CHANGES.
To work with the most recent code from the development branch of it, clone the master git repository:
git clone –recursive https://github.com/zeek/zeek
With all dependencies in place, build and install:
./configure && make && sudo make install
Write your first Zeek script:
# File “hello.zeek”
event zeek_init()
{
print “Hello World!”;
}
And run it:
zeek hello.zeek
For learning more about the it scripting language, try.zeek.org is a great resource.
It is developed on GitHub by its community. We welcome contributions. Working on an open source project like it can be an incredibly rewarding experience and, packet by packet, makes the Internet a little safer. Today, as a result of countless contributions, it is used operationally around the world by major companies and educational and scientific institutions alike for securing their cyber infrastructure.
If you’re interested in getting involved, we collect feature requests and issues on GitHub here and you might find these to be a good place to get started. More information on it’s development can be found here, and information about its community and mailing lists (which are fairly active) can be found here.
