In last month's community discussion, we learned how practitioners are building detection from their own historical data:
https://zeek.org/2026/07/what-actually-catches-threats-in-a-zeek-deployment/
#Zeek #NetworkSecurity #OpenSource
#zeek
11 posts · Last used Oct 10
Can LLMs help run Zeek in production?
Aashish is joining us at Zeek Workshop Berkeley to talk about real-world wins and failures from a year of using AI for incident response.
It's the final call to snag your seat: https://zeek.org/zeek-workshop-berkeley-2026/
#Zeek #NetworkSecurity
When PCAPs aren't available, can't be shared, or your script depends on external services, standard BTests need a different approach.
Part 2 of Yacin's testing series walks through hand-crafting events and using Zeek's built-in event tracing flag.
Read Part 2: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-2/
#Zeek #NetworkSecurity #BTest #OpenSource
If you use #Zeek at all, please go take the 2026 project survey.
#PCAP #NetworkTrafficAnalysis #networksecuritymonitoring #CyberSecurity #Cyber #Infosec
If your Zeek package relies on helper functions to process data before writing to a log, you don't need a PCAP to test that logic.
Part 1 of Yacin's new testing series demonstrates how to emulate unit testing frameworks inside BTest using Zeek 6.1's native assert statement.
Read the walkthrough: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-1/
#Zeek #NetworkSecurity #OpenSource #BTest
release notes for Malcolm v26.07.1, a network traffic analysis tool suite for network security monitoring
Sensitive
Any Zeek enthusiasts who have experience or guidance for installing Zeek in Azure to monitor traffic to hosted services (app gateway to private endpoints)?
Azure TAP/SPAN features totally suck, they have failed to get this right 10 years on. Looking to see if there is a way someone has figured out that doesn't involve crazy load balancing architectures with VMs simply for the purpose of a a NIC to tap.
Thanks!
#zeek
We launched a new Contribution Guide earlier this month to fix the biggest hurdle from last year's community survey: "I don't know where to start."
What should we fix next? Tell us in the 2026 survey (open until August 14):
zeek.org/survey
#Zeek #OpenSource #NetworkSecurity
The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek.
Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/
#NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley
How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2.
The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too.
https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/
#Zeek #NetworkSecurity #OpenSource #Spicy
RE: https://infosec.exchange/@zeek/116874651875783351
If you're still manually piecing together separate MIME attachments or body segments during email analysis, you're doing unnecessary work.
Zeek has a built-in event that automatically combines it all into a single, cohesive string: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006#p-29791-zeek-techniques-5
#Zeek #NetworkSecurity #EmailSecurity
Quoting
RE: https://infosec.exchange/@zeek/116852154229547483
We shared a cool first-time contributor story in our newsletter this month - check out the dev update to learn about how they extended the LDAP analyzer to forward NTLM and Kerberos authentication data to their respective analyzers:
Open quoted post
You've seen all posts