Zeek

The Zeek team is proud to announce Zeek 8.2! This release marks our final checkpoint on the road to Zeek 9, and rounds out our new ZeroMQ support in important ways. It also includes a range of new features and improvements, so let’s cover the highlights in this blog post...

Getting Zeek deployed is one thing. Keeping it running well is another, and it looks different for every environment. Last month, we asked the Zeek community: once Zeek is in production, what does the ongoing care actually look like? What do you monitor, what have you automated, and what have you learned the hard way?

The answers varied by environment, but three themes...

Zeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both.

There are several reasons one might want two log formats simultaneously. For example, you could log TSV files to disk for long-term archiving, and send off json-logs to your SIEM platform...