zeek/zeek

Features

• Network Security Monitoring - Monitors network traffic and detects malicious activity using customizable detection policies.
• Network Activity Archiving - Maintains detailed historical records of network events and application state for forensic investigation and auditing.
• Network Analysis - Provides a comprehensive framework for capturing, monitoring, and analyzing network traffic.
• Modular Analyzers - Employs a set of pluggable analyzers that decode specific application-layer protocols into a common event format.
• Event-Driven Scripting - Executes custom analysis logic by triggering scripts based on real-time network events.
• Network Traffic Analyzers - Transforms raw network packets into high-level semantic logs for security monitoring.
• Application-Layer Protocol Inspections - Performs deep semantic analysis of numerous application-layer protocols to extract meaning from traffic.
• Network Intrusion Detection - Monitors network traffic for suspicious patterns and malicious activity using customizable policies.
• Protocol - Maintains persistent internal tables that map network connections to their current protocol state.
• Protocol State Machines - Tracks application-layer state over time to reconstruct high-level conversations from individual packets.
• Packet-to-Log Pipelines - Converts raw binary network traffic into structured semantic logs through a multi-stage analysis pipeline.
• Application Layer Protocol Dissectors - Functions as a system that reconstructs and decodes application-layer protocols from raw network traffic.
• Network Activity Archiving - Maintains extensive application-layer state to provide a high-level historical record of all network activity.
• Network Traffic Analysis - Converts raw network packets into high-level semantic logs to monitor application layer activity.
• Custom Logic Extensions - Provides mechanisms to tailor monitoring behavior and log generation via a specialized scripting language.
• Domain Specific Languages - Provides a specialized domain-specific language for defining network monitoring policies and behavior rules.
• Monitoring Policies - Allows the definition of custom detection approaches and site-specific monitoring rules.
• Security and Compliance - Network analysis framework for security monitoring.

Star history