Integrating Zeek With Third-Party Applications

Christian Kreibich, tech lead of the Zeek project, explains how external applications can be connected to a running Zeek deployment. He first outlines the architecture: packet parsing produces events, which a scripting layer processes, and the processes of a cluster exchange those events over publish-subscribe message buses. Any application that speaks websockets can join this bus through a port on the manager node, subscribe to topics, and publish events as if it were a Zeek process.

The middle of the talk covers integration patterns from real deployments. A large university used enrichment data, such as which department or Wi-Fi network an address range belongs to, to add context to its logs. Machine learning verdicts came back through paired events acting like remote procedure calls, and a host agent added user and application details to connection logs. Other examples included YARA file analysis fed by a job queue, blocking abusive hosts at a research lab, and threat indicator import from MISP. Older file-based frameworks and the database-backed storage framework were also covered.

The closing advice favours the event interface with the provided client libraries over the legacy Broker library, and a single websocket connection rather than many. The Q&A added that Zeek does not deduplicate traffic and that packet sampling at the tap removes the detail needed for parsing. The speaker invited developers building integrations to get in touch with the project.