Zeek

What Zeek does

Zeek is an open-source network security monitoring (NSM) platform that operates passively on network sensors—hardware, software, virtual, or cloud-based—to analyze traffic in real-time and generate high-fidelity transaction logs, file contents, and customizable outputs. Originally developed by Vern Paxson in the 1990s as "Bro" at Lawrence Berkeley National Laboratory and ICSI, the project was renamed Zeek in 2018 and now serves security operations teams across enterprise networks, cloud environments, research computing facilities, and operational technology (OT/ICS) deployments. The platform tracks 3,000+ network event types, produces 70+ default log files, and integrates with Kafka, Splunk, Elasticsearch, Suricata, AWS Traffic Mirroring, and SIEM platforms. Custom protocol analyzers can be developed using the Spicy parser toolkit, and a network-optimized scripting language (ZeekScript) enables extensive customization of detection logic for organization-specific use cases. Notable deployment sites include NERSC (monitoring up to 1Tbps of border traffic), Meta (15 billion connections daily), ESnet, Idaho National Laboratory, NTT Communications, CERN, and NCAR.

The project operates under a community governance model with a Leadership Team drawn from Corelight (the project's primary custodian providing financial backing and most core maintainers), Lawrence Berkeley Lab, ESnet, Idaho National Lab, and UC Berkeley. Funding sources include NSF grants—notably the Bro Center of Expertise (NSF Award ACI-1348077)—and Corelight's ongoing commercial sponsorship. Distribution is entirely free under the BSD license, with no direct revenue generated by the Zeek Project itself; commercial monetization of Zeek's technology occurs outside the project at Corelight and other vendors that build products on top of it. The community footprint includes 10,000+ estimated deployments worldwide, 7,700+ GitHub stars, 270+ community-contributed packages, and active engagement across GitHub, Slack, Discourse, Mastodon, Bluesky, and YouTube, with annual events such as ZeekWeek and the new Zeek Workshop Europe at CERN driving awareness and contributor onboarding.

Name

Zeek

Legal name

The Zeek Project

Website

https://zeek.org

Company type

Private

Founded year

1990

Operating status

Operating

Ownership category

akta.pro rank

Product category

Open-source Network Security Monitoring

NAICS

Computer Systems Design and Related Services (5415), Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming Services (7371), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

akta.pro secondary industry

Infrastructure & Network Monitoring (NPM/NPMD) (HDABAJAA)

Keywords

• Network security monitoring
• Open source NSM
• Passive traffic analysis
• Protocol parsing
• Security logging

Headquarters

HQ city

Urbana

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Open Source Distribution: Zeek is freely available as open-source software under the BSD license. The project does not generate direct revenue from software licensing. The project is supported by Corelight (financial backing, code contributions) and NSF funding for R&D.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels11 records

Core offering

Zeek is a free, open-source passive network security monitoring platform that analyzes network traffic in real-time on hardware, software, virtual, or cloud sensors, generating 70+ default transaction log files and tracking 3,000+ network event types. It includes a powerful network-optimized scripting language (ZeekScript), the Spicy parser toolkit for custom protocol analysis, a package manager with 270+ community packages, and frameworks for storage, telemetry, file analysis, and intelligence matching. Zeek targets enterprise SOCs, cloud and HPC environments, OT/ICS networks, and research institutions needing deep network visibility for threat detection, incident response, and forensics.

Product overview

Zeek is an open-source network security monitoring platform that operates as a passive sensor analyzing network traffic in real-time. The core product generates high-fidelity transaction logs, file contents, and fully customizable outputs. The platform includes ZeekScript (a powerful scripting language for customization), the Zeek Package Manager (for community-contributed extensions), Spicy (a parser toolkit for developing protocol analyzers), and built-in frameworks for testing (btest), storage, and telemetry. Try Zeek provides browser-based access, and Zeek Agent extends visibility to host-level activity. The system tracks 3,000+ network event types and provides 70+ log files by default, supporting enterprise, cloud, and industrial computing environments.

Differentiator

Problem solved

Functional benefit

Products and services

• Zeek Network Security Monitor The core open-source passive network security monitoring platform that analyzes network traffic in real-time on hardware, software, virtual, or cloud sensors, generating 70+ high-fidelity transaction log files and tracking 3,000+ network event types for SOC analysts and SIEM integration.
• Zeek Package Manager A package management system that extends Zeek functionality with 270+ community-contributed packages for protocol parsers, detections, and integrations.
• Try Zeek Online A hosted sandbox that lets prospective users run Zeek in a browser to evaluate the platform without installing or configuring local infrastructure.
• Spicy A parser toolkit and strongly-typed scripting language for developing custom Zeek protocol analyzers, providing a streamlined alternative to BinPAC.
• Zeek Storage Framework A framework for storing and managing data across Zeek clusters, replacing the legacy Broker Storage model with improved efficiency and flexibility.
• Zeek Telemetry Framework A framework for exporting Zeek's own operational metrics using a Prometheus-first telemetry model.
• Zeek Agent A companion agent that extends Zeek's visibility beyond passive network traffic to include host-level activity.
• btest Zeek's built-in testing framework that creates baselines and compares script output against expected results from PCAP traces.

Quantifiable outcome

• At ESnet: Reduced daily weird alerts from ~4.2M to ~1.3M (70% reduction) by fixing one DNS opcode parsing issue, saving on SIEM ingestion costs
• +2 more outcomes

Named customers7 records

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

Feature10 records

Partnerships

Six partnerships are on record, tiered core and major.

• CorelightcoreStrategic or Co-development Partner · 1 January 2018Corelight serves as the custodian of the Zeek project. While not the owner, Corelight actively supports Zeek by providing financial backing, contributing code, and advocating for the project within the cybersecurity community. Most of Zeek's maintainers are Corelight employees who work on the open-source project as part of their roles.
• National Center for Supercomputing Applications (NCSA)majorStrategic or Co-development Partner · 1 January 2011NCSA partnered with ICSI to host the Bro Center of Expertise. NCSA has been a leader in security R&D and operations for over 10 years, hosting multiple Bro Exchange and Workshop events.
• International Computer Science Institute (ICSI)coreStrategic or Co-development Partner · 1 January 1995ICSI in Berkeley, CA is where Zeek was originally headquartered. The 501(c)(3) nonprofit organization played a key role in Zeek's early development. Founder Vern Paxson and core team members were associated with ICSI.
• Lawrence Berkeley National LaboratorymajorStrategic or Co-development PartnerLBNL hosts leadership team members (Aashish Sharma) and has been an early adopter and contributor to Zeek. NERSC, a division of LBNL, uses Zeek to monitor up to 1Tbps of traffic.
• ESnetmajorStrategic or Co-development PartnerESnet hosts leadership team member Fatema Bannat Wala and provides cutting-edge infrastructure for testing and deployment. ESnet automatically builds and tests new Zeek branches across their infrastructure.
• Idaho National Laboratory (INL)majorStrategic or Co-development PartnerINL hosts leadership team member Seth Grover and develops Malcolm (open-source network traffic analysis tool) and ICSNPP project for Industrial Control Systems protocol parsers using Zeek.

Scale indicators6 records

Recent moves7 records

Expansion highlights6 records

Others

• Elastic Security: SIEM/analytics platform that ingests Zeek logs; an ecosystem partner and adjacent competitor for security analytics on network telemetry.
• Corelight: Commercial NDR vendor and Zeek's custodian that builds enterprise appliances and cloud sensors on top of Zeek; deeply intertwined but monetizes the technology commercially.
• Wireshark: Open-source packet analysis tool used for network traffic inspection; overlaps with Zeek on deep packet visibility though focused on interactive analysis rather than continuous monitoring.

Broad incumbents

• Darktrace: Commercial AI-driven NDR platform targeting the same enterprise network detection and response market, but as a proprietary turnkey product.
• ExtraHop: Commercial network detection and response and network performance monitoring platform overlapping with Zeek's traffic analysis and visibility use cases.
• Vectra AI: Commercial network detection and response vendor competing for enterprise network-threat visibility budgets that Zeek deployments also address.

Direct peers

• Suricata (OISF): Open-source network threat detection engine frequently deployed alongside or as an alternative to Zeek for network security monitoring, sharing the same passive-sensor use case.
• Security Onion: Open-source network security monitoring distribution that bundles Zeek and Suricata; both a peer and integration partner in the NSM category.
• Snort (Cisco): Widely used open-source network intrusion detection/prevention system serving the same network threat-detection buyers as Zeek.
• Arkime: Open-source large-scale packet capture and network traffic analysis tool that competes for the same full-visibility network forensics use case as Zeek.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/zeek/zeek
• YouTubeyoutube.com/zeekurity
• Xx.com/Zeekurity

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Zeek