Zeek
- Company typePrivate
- Founded1990
- HeadquartersUrbana, United States
- Headcount—
- GTM typeB2B
- OfferingSoftware
What Zeek does
Zeek is an open-source network security monitoring (NSM) platform that operates passively on network sensors—hardware, software, virtual, or cloud-based—to analyze traffic in real-time and generate high-fidelity transaction logs, file contents, and customizable outputs. Originally developed by Vern Paxson in the 1990s as "Bro" at Lawrence Berkeley National Laboratory and ICSI, the project was renamed Zeek in 2018 and now serves security operations teams across enterprise networks, cloud environments, research computing facilities, and operational technology (OT/ICS) deployments. The platform tracks 3,000+ network event types, produces 70+ default log files, and integrates with Kafka, Splunk, Elasticsearch, Suricata, AWS Traffic Mirroring, and SIEM platforms. Custom protocol analyzers can be developed using the Spicy parser toolkit, and a network-optimized scripting language (ZeekScript) enables extensive customization of detection logic for organization-specific use cases. Notable deployment sites include NERSC (monitoring up to 1Tbps of border traffic), Meta (15 billion connections daily), ESnet, Idaho National Laboratory, NTT Communications, CERN, and NCAR.
The project operates under a community governance model with a Leadership Team drawn from Corelight (the project's primary custodian providing financial backing and most core maintainers), Lawrence Berkeley Lab, ESnet, Idaho National Lab, and UC Berkeley. Funding sources include NSF grants—notably the Bro Center of Expertise (NSF Award ACI-1348077)—and Corelight's ongoing commercial sponsorship. Distribution is entirely free under the BSD license, with no direct revenue generated by the Zeek Project itself; commercial monetization of Zeek's technology occurs outside the project at Corelight and other vendors that build products on top of it. The community footprint includes 10,000+ estimated deployments worldwide, 7,700+ GitHub stars, 270+ community-contributed packages, and active engagement across GitHub, Slack, Discourse, Mastodon, Bluesky, and YouTube, with annual events such as ZeekWeek and the new Zeek Workshop Europe at CERN driving awareness and contributor onboarding.
Zeek firmographics
Firmographics- Name
- Zeek
- Legal name
- The Zeek Project
- Website
- https://zeek.org
- Company type
- Private
- Founded year
- 1990
- Operating status
- Operating
- Ownership category
- akta.pro rank
Zeek industry classification
Industry- Product category
- Open-source Network Security Monitoring
- NAICS
- Computer Systems Design and Related Services (5415), Computer Systems Design and Related Services (54151)
- SIC
- Services-Computer Programming Services (7371), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
- akta.pro secondary industry
- Infrastructure & Network Monitoring (NPM/NPMD) (HDABAJAA)
Keywords
Where Zeek is headquartered
LocationHeadquarters
- HQ city
- Urbana
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Zeek business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Open Source Distribution: Zeek is freely available as open-source software under the BSD license. The project does not generate direct revenue from software licensing. The project is supported by Corelight (financial backing, code contributions) and NSF funding for R&D.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Free Open Source - No pricing |
Go-to-market motion1 record
Distribution channels4 records
Marketing channels11 records
Zeek product offering
Product offeringCore offering
Zeek is a free, open-source passive network security monitoring platform that analyzes network traffic in real-time on hardware, software, virtual, or cloud sensors, generating 70+ default transaction log files and tracking 3,000+ network event types. It includes a powerful network-optimized scripting language (ZeekScript), the Spicy parser toolkit for custom protocol analysis, a package manager with 270+ community packages, and frameworks for storage, telemetry, file analysis, and intelligence matching. Zeek targets enterprise SOCs, cloud and HPC environments, OT/ICS networks, and research institutions needing deep network visibility for threat detection, incident response, and forensics.
Product overview
Zeek is an open-source network security monitoring platform that operates as a passive sensor analyzing network traffic in real-time. The core product generates high-fidelity transaction logs, file contents, and fully customizable outputs. The platform includes ZeekScript (a powerful scripting language for customization), the Zeek Package Manager (for community-contributed extensions), Spicy (a parser toolkit for developing protocol analyzers), and built-in frameworks for testing (btest), storage, and telemetry. Try Zeek provides browser-based access, and Zeek Agent extends visibility to host-level activity. The system tracks 3,000+ network event types and provides 70+ log files by default, supporting enterprise, cloud, and industrial computing environments.
Differentiator
Problem solved
Functional benefit
Products and services
- Zeek Network Security Monitor The core open-source passive network security monitoring platform that analyzes network traffic in real-time on hardware, software, virtual, or cloud sensors, generating 70+ high-fidelity transaction log files and tracking 3,000+ network event types for SOC analysts and SIEM integration.
- Zeek Package Manager A package management system that extends Zeek functionality with 270+ community-contributed packages for protocol parsers, detections, and integrations.
- Try Zeek Online A hosted sandbox that lets prospective users run Zeek in a browser to evaluate the platform without installing or configuring local infrastructure.
- Spicy A parser toolkit and strongly-typed scripting language for developing custom Zeek protocol analyzers, providing a streamlined alternative to BinPAC.
- Zeek Storage Framework A framework for storing and managing data across Zeek clusters, replacing the legacy Broker Storage model with improved efficiency and flexibility.
- Zeek Telemetry Framework A framework for exporting Zeek's own operational metrics using a Prometheus-first telemetry model.
- Zeek Agent A companion agent that extends Zeek's visibility beyond passive network traffic to include host-level activity.
- btest Zeek's built-in testing framework that creates baselines and compares script output against expected results from PCAP traces.
Quantifiable outcome
- At ESnet: Reduced daily weird alerts from ~4.2M to ~1.3M (70% reduction) by fixing one DNS opcode parsing issue, saving on SIEM ingestion costs
- +2 more outcomes
Companies that use Zeek
Customer profileNamed customers7 records
Segments5 records
Ideal customer profiles4 records
Zeek technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration9 records
Feature10 records
Zeek partnerships and signals
Strategic signalPartnerships
Six partnerships are on record, tiered core and major.
- CorelightcoreCorelight serves as the custodian of the Zeek project. While not the owner, Corelight actively supports Zeek by providing financial backing, contributing code, and advocating for the project within the cybersecurity community. Most of Zeek's maintainers are Corelight employees who work on the open-source project as part of their roles.
- National Center for Supercomputing Applications (NCSA)majorNCSA partnered with ICSI to host the Bro Center of Expertise. NCSA has been a leader in security R&D and operations for over 10 years, hosting multiple Bro Exchange and Workshop events.
- International Computer Science Institute (ICSI)coreICSI in Berkeley, CA is where Zeek was originally headquartered. The 501(c)(3) nonprofit organization played a key role in Zeek's early development. Founder Vern Paxson and core team members were associated with ICSI.
- Lawrence Berkeley National LaboratorymajorLBNL hosts leadership team members (Aashish Sharma) and has been an early adopter and contributor to Zeek. NERSC, a division of LBNL, uses Zeek to monitor up to 1Tbps of traffic.
- ESnetmajorESnet hosts leadership team member Fatema Bannat Wala and provides cutting-edge infrastructure for testing and deployment. ESnet automatically builds and tests new Zeek branches across their infrastructure.
- Idaho National Laboratory (INL)majorINL hosts leadership team member Seth Grover and develops Malcolm (open-source network traffic analysis tool) and ICSNPP project for Industrial Control Systems protocol parsers using Zeek.
Scale indicators6 records
Recent moves7 records
Expansion highlights6 records
Zeek competitors and assessment
Company assessmentOthers
- Elastic Security: SIEM/analytics platform that ingests Zeek logs; an ecosystem partner and adjacent competitor for security analytics on network telemetry.
- Corelight: Commercial NDR vendor and Zeek's custodian that builds enterprise appliances and cloud sensors on top of Zeek; deeply intertwined but monetizes the technology commercially.
- Wireshark: Open-source packet analysis tool used for network traffic inspection; overlaps with Zeek on deep packet visibility though focused on interactive analysis rather than continuous monitoring.
Broad incumbents
- Darktrace: Commercial AI-driven NDR platform targeting the same enterprise network detection and response market, but as a proprietary turnkey product.
- ExtraHop: Commercial network detection and response and network performance monitoring platform overlapping with Zeek's traffic analysis and visibility use cases.
- Vectra AI: Commercial network detection and response vendor competing for enterprise network-threat visibility budgets that Zeek deployments also address.
Direct peers
- Suricata (OISF): Open-source network threat detection engine frequently deployed alongside or as an alternative to Zeek for network security monitoring, sharing the same passive-sensor use case.
- Security Onion: Open-source network security monitoring distribution that bundles Zeek and Suricata; both a peer and integration partner in the NSM category.
- Snort (Cisco): Widely used open-source network intrusion detection/prevention system serving the same network threat-detection buyers as Zeek.
- Arkime: Open-source large-scale packet capture and network traffic analysis tool that competes for the same full-visibility network forensics use case as Zeek.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat6 records
Key risks6 records
Key highlights6 records
Customer concentration
Zeek social profiles
Digital presenceZeek financial estimates
Financial estimateRevenue estimate
Valuation estimate
Zeek leadership team
Management profileNumber of profiles
Profiles8 records
Zeek funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Zeek M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Zeek
What does Zeek do?
Zeek is a free, open-source passive network security monitoring platform that analyzes network traffic in real-time on hardware, software, virtual, or cloud sensors, generating 70+ default transaction log files and tracking 3,000+ network event types. It includes a powerful network-optimized scripting language (ZeekScript), the Spicy parser toolkit for custom protocol analysis, a package manager with 270+ community packages, and frameworks for storage, telemetry, file analysis, and intelligence matching. Zeek targets enterprise SOCs, cloud and HPC environments, OT/ICS networks, and research institutions needing deep network visibility for threat detection, incident response, and forensics.
Is Zeek a public or private company?
Zeek is a private company. It is classified as nonprofit foundation owned and is currently operating.
When was Zeek founded?
Zeek was founded in 1990.
Where is Zeek based?
Zeek is headquartered in Urbana, United States, in the North America region.
How does Zeek make money?
One revenue line is on record: open Source Distribution.
Who are Zeek's main competitors?
Others on record are Elastic Security, Corelight and Wireshark. Broad incumbents are Darktrace, ExtraHop and Vectra AI. Direct peers are Suricata (OISF), Security Onion, Snort (Cisco) and Arkime.
Does Zeek have an API?
No public API is recorded for Zeek.
What industry is Zeek in?
Zeek's product category is Open-source Network Security Monitoring. Its primary akta.pro industry code is HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud), with a secondary code of HDABAJAA, Infrastructure & Network Monitoring (NPM/NPMD). Its NAICS code is 5415 and its SIC code is 7371.