New Features In The Zeek Network Monitor

The Zeek project lead gives an update on what has changed in Zeek since version 6.0. He opens with a refresher on the system: it takes packets from live taps or capture files, runs a large set of protocol analyzers, and raises typed events that users handle in Zeek's own scripting language. Default scripts turn those events into logs, such as a connection log that works like enriched flow records, and the output can be written to disk or streamed to systems like Kafka or Splunk. He explains that Zeek scales by running many cooperating processes in a cluster rather than relying on threads.

The middle of the talk covers recent additions. Zeek now accepts JavaScript as a scripting option, and a MISP integration built on the threat intelligence framework shows how HTTP API work is easier to express that way. Parsers written in Spicy are gaining adoption, with a second Spicy implementation of the TLS parser running side by side with the existing one for comparison. Performance work includes an optional script compiler and removal of unnecessary polling and work, with one heavy TCP configuration reported as roughly twice as fast.

Looking ahead, the roadmap includes a pluggable cluster messaging backend with NATS and ZeroMQ prototypes, a pluggable key-value storage layer with PostgreSQL and SQLite under consideration, and a cluster manager better suited to modern service-oriented infrastructure. The speaker also discussed possibly removing the logger node role. For practitioners, the main point is that Zeek turns traffic into queryable logs that support retrospective investigation and custom behavioral detection.