image
A powerful framework for network traffic analysis and security monitoring. _ Key Features _ — _ Documentation _ — _ Getting Started _ — _ Development _ — _ License _ Follow us on Twitter at @zeekurity . Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer. Adaptable and Flexible Zeek's domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach. Efficient Zeek targets high-performance networks and is used operationally at a variety of large sites. Highly Stateful Zeek keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network's activity. Getting Started The best place to find information about getting started with Zeek is our web site www.zeek.org , specifically the documentation section there. On the web site you can also find downloads for stable releases, tutorials on getting Zeek set up, and many other useful resources. You can find release notes in NEWS , and a complete record of all changes in CHANGES . To work with the most recent code from the development branch of Zeek, clone the master git repository: git clone –recursive https://github.com/zeek/zeek With all dependencies in place, build and install: ./configure && make && sudo make install Write your first…