Zeek: Turning Network Traffic Into Structured Logs
Zeek is not an intrusion detection system in the signature-matching sense, which is the thing to understand before evaluating it. It converts network traffic into structured logs describing what happened, and leaves the question of what is suspicious to you.
What it produces
For every connection: source, destination, ports, duration, bytes each way, and the connection state.
Then per-protocol logs. dns.log records every query and response. ssl.log records every TLS handshake with server name, certificate subject, and validation status. http.log records requests. files.log records transferred files with hashes. notice.log records things Zeek considers worth flagging.
These are structured and greppable, which makes them genuinely useful rather than an archive you never touch.
Why logs beat alerts
A signature-based system like Suricata answers “did something known-bad happen.” That is valuable and it only covers attacks someone has written a rule for.
Zeek answers “what happened,” which is the question you actually have during an investigation. Which internal host contacted that address, when, how much data moved, and what certificate the server presented. None of that requires knowing in advance what you are looking for.
The two are complementary and frequently deployed together.
The scripting language
Zeek’s own event-driven language lets you write detection logic against protocol events. Detect a host making an unusual number of failed DNS lookups, flag a certificate signed by an unexpected CA, alert on file hashes matching a list.
This is where the depth is, and it is also a real learning investment.
Practical notes
Zeek needs traffic: a mirror port, a tap, or a bridge position. It cannot analyse what it does not see, and on a switched network that means configuring port mirroring deliberately.
Log volume is substantial on a busy network. Plan retention and rotation before you start, and consider shipping logs to a central store rather than keeping them locally.
Encrypted traffic limits content visibility, as everywhere. The metadata remains extremely informative.
Where it fits
A homelab or small network where you want a record of what happened rather than only alerts about what is known bad. Pairs naturally with Suricata for signatures and Arkime for full packet capture.
License
Zeek is released under the BSD-3-Clause License.