What it does
Zeek is an open-source passive network monitor that produces structured transaction logs and supports custom analysis scripts.
Zeek is useful when analysts need searchable records of network behavior rather than only raw packets. Its passive sensor generates protocol and transaction logs that can feed a SIEM or a manual investigation. Choose which network segment will be visible to the sensor and how long its logs should be retained. Zeek's page explicitly distinguishes passive monitoring from active blocking. Use that distinction when assigning it a role alongside a firewall or prevention system.
Strengths
- Rich structured network logs
- Scriptable passive analysis
Watch out for
- Passive monitoring does not itself block network activity
Best for
- Defenders building network investigation visibility
Sources
- Zeek: The Open Source Network Monitor (Oct 26, 2026)
- Zeek COPYING (Oct 26, 2026)