zeek/zeek
Zeek
Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity.
The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous application-layer protocols.
Its broader capabilities include network traffic analysis, network security monitoring, and the ability to define site-specific monitoring rules to detect threats and anomalies.
Features
- Network Security Monitoring - Monitors network traffic and detects malicious activity using customizable detection policies.
- Network Activity Archiving - Maintains detailed historical records of network events and application state for forensic investigation and auditing.
- Network Analysis - Provides a comprehensive framework for capturing, monitoring, and analyzing network traffic.
- Modular Analyzers - Employs a set of pluggable analyzers that decode specific application-layer protocols into a common event format.
- Event-Driven Scripting - Executes custom analysis logic by triggering scripts based on real-time network events.
- Network Traffic Analyzers - Transforms raw network packets into high-level semantic logs for security monitoring.
- Application-Layer Protocol Inspections - Performs deep semantic analysis of numerous application-layer protocols to extract meaning from traffic.
- Network Intrusion Detection - Monitors network traffic for suspicious patterns and malicious activity using customizable policies.
- Protocol - Maintains persistent internal tables that map network connections to their current protocol state.
- Protocol State Machines - Tracks application-layer state over time to reconstruct high-level conversations from individual packets.
- Packet-to-Log Pipelines - Converts raw binary network traffic into structured semantic logs through a multi-stage analysis pipeline.
- Application Layer Protocol Dissectors - Functions as a system that reconstructs and decodes application-layer protocols from raw network traffic.
- Network Activity Archiving - Maintains extensive application-layer state to provide a high-level historical record of all network activity.
- Network Traffic Analysis - Converts raw network packets into high-level semantic logs to monitor application layer activity.
- Custom Logic Extensions - Provides mechanisms to tailor monitoring behavior and log generation via a specialized scripting language.
- Domain Specific Languages - Provides a specialized domain-specific language for defining network monitoring policies and behavior rules.
- Monitoring Policies - Allows the definition of custom detection approaches and site-specific monitoring rules.
- Infrastructure Monitoring - Network analysis framework.
- Network Monitoring Tools - Network security monitoring and analysis tool.
- Security and Compliance - Network analysis framework for security monitoring.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
