The Zeek Network Security Monitor

Can LLMs help run Zeek in production? Aashish is joining us at Zeek Workshop Berkeley to talk about real-world wins and failures from a year of using AI for incident response. It's the final call to snag your seat: https://zeek.org/zeek-workshop-berkeley-2026/ #Zeek #NetworkSecurity

If your Zeek package relies on helper functions to process data before writing to a log, you don't need a PCAP to test that logic. Part 1 of Yacin's new testing series demonstrates how to emulate unit testing frameworks inside BTest using Zeek 6.1's native assert statement. Read the walkthrough: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-1/ #Zeek #NetworkSecurity #OpenSource #BTest

The speaker lineup for our upcoming workshop is starting to take shape, and we're kicking things off with a look-back on 30 years of Zeek. Schedule: https://zeek.org/zeek-workshop-berkeley-2026/schedule-berkeley/ #NetSec #OpenSource #Metadata #Zeek #Bro #Networking #LBNL #UCBerkeley

Our annual community survey is open through August 14. It's short, anonymous, and worth knowing about if you're using Zeek! Other community updates in our newsletter: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006/1 Survey here: https://zeek.org/survey

We're excited to share our updated Contribution Guide, inspired by recent feedback from the Zeek community. Our goal is to make it easier to contribute to the project. Learn more: https://zeek.org/2026/07/weve-updated-the-zeek-contribution-guide/

RE: https://infosec.exchange/@zeek/116879590940339962 Where does Sigma matching belong in your network security stack? It's a critical architectural question when deciding exactly where detection logic should live. Revisit our recent community discussion exploring what actually catches threats in a Zeek deployment:

RE: https://infosec.exchange/@zeek/116874651875783351 If you're still manually piecing together separate MIME attachments or body segments during email analysis, you're doing unnecessary work. Zeek has a built-in event that automatically combines it all into a single, cohesive string: https://community.zeek.org/t/zeek-newsletter-issue-64-june-2026/8006#p-29791-zeek-techniques-5 #Zeek #NetworkSecurity #EmailSecurity

How much progress can a parser generator make in a year? We've updated our Spicy vs. Binpac benchmarks for Zeek 8.2. The tl;dr: Key unit cases are up to 1.6x faster, and real-world SSL parsing sees a nice boost too. https://zeek.org/2026/07/spicy-vs-binpac-performance-one-year-later/ #Zeek #NetworkSecurity #OpenSource #Spicy

RE: https://infosec.exchange/@zeek/116852154229547483 Want to expand what your Zeek deployment can see and do? Two new community-contributed packages just joined the Zeek ecosystem, tackling two very different operational challenges. Get the full details and installation commands in our June newsletter:

We launched a new Contribution Guide earlier this month to fix the biggest hurdle from last year's community survey: "I don't know where to start." What should we fix next? Tell us in the 2026 survey (open until August 14): zeek.org/survey #Zeek #OpenSource #NetworkSecurity

RE: https://infosec.exchange/@zeek/116925801508243282 Have you marked your calendar yet? Join us in Berkeley September 10 & 11: https://zeek.org/zeek-workshop-berkeley-2026/registration-berkeley/

RE: https://infosec.exchange/@zeek/116919245094511768 Spicy makes writing Zeek parsers safe and easy, but legacy Binpac has historically held the crown for raw speed. Can the latest Spicy optimizations actually close that gap under a real production load? We skipped the sterile microbenchmarks and put them to the test against real-world network traffic. Read the full performance breakdown:

This Wednesday we'll be meeting on Zoom for our monthly Community Call. Link to join can be found here: https://zeek.org/events/

When PCAPs aren't available, can't be shared, or your script depends on external services, standard BTests need a different approach. Part 2 of Yacin's testing series walks through hand-crafting events and using Zeek's built-in event tracing flag. Read Part 2: https://zeek.org/2026/07/the-cure-for-exceptional-zeek-package-testing-part-2/ #Zeek #NetworkSecurity #BTest #OpenSource

RE: https://infosec.exchange/@zeek/117032972009131346 We'll be sharing the latest Zeek project news at 10am Pacific tomorrow. Tune in to learn what we've been working on: https://zeek.org/events/

What's new with us? Find out in our latest newsletter: https://community.zeek.org/t/zeek-newsletter-issue-65-july-2026/8013