Zeek¶

Zeek is an open-source network analysis framework and security monitoring tool. Zeek provides deep visibility into network traffic and enables organisations to detect and respond to security threats in real-time. Unlike traditional intrusion detection systems (IDS) that rely primarily on signature matching, Zeek offers a more flexible and comprehensive approach by analysing network behaviors and events.

Watch the Zeek overview on YouTube

Choose your journey¶

Choose the activity that matches your goal. You can complete one journey independently or use the hands-on labs page to work through the full evidence workflow.

01 Install Zeek Prepare an offline Ubuntu sensor and install the required packages. Complete when the Zeek binaries and ZeekControl start successfully. Intermediate · Ubuntu 22.04 · 30–60 min

02 Monitor live traffic Configure ZeekControl, select an interface, and inspect rotated logs. Complete when Zeek produces current logs from authorised traffic. Intermediate · Zeek sensor · 30–45 min

03 Analyse a PCAP Capture safe traffic or process an existing packet capture. Complete when the PCAP produces an explainable set of Zeek logs. Beginner · Linux analysis host · 20–30 min

04 Inspect Zeek logs Compare TSV and JSON logs, then query them with zeek-cut and jq. Complete when you can extract and explain the fields relevant to an investigation. Intermediate · Zeek CLI · 45–60 min

05 Integrate with Suricata Process the same PCAP with Suricata for signature-based detection. Complete when Suricata reports the expected alert from the shared evidence. Intermediate · Zeek and Suricata · 20–30 min

06 Use intelligence Load a safe indicator and confirm a match in intel.log. Complete when the expected indicator and source appear in intel.log. Intermediate · ZeekControl · 30–45 min

07 Build your Zeek lab Follow the complete workflow and retain reproducible evidence. Complete when another analyst can reproduce your findings. Intermediate · Complete lab · 2–3 hours

Before you begin¶

Tested environment¶

The procedures and topology record a proof-of-concept environment. Package names, paths, and output can change between Zeek and Ubuntu releases.

Component	Version used in the PoC	Notes
Zeek	Repository packages for Ubuntu 22.04	Validate package availability before building an offline bundle
Ubuntu sensor	Ubuntu 22.04 LTS	Hosts both Zeek and Suricata in this PoC
FortiGate	FortiOS 7.6.0	Provides routing for the local lab
Analysis tools	`zeek-cut`, `jq`, `tcpdump`	Used to capture and inspect evidence

Record the versions, download sources, checksums, interface names, and validation date used in your own build.

How evidence moves through this PoC¶

1Traffic or PCAP 2Protocol analysis 3Structured logs 4UID correlation 5Query and finding

When troubleshooting, work from left to right: confirm Zeek saw the traffic, identify the expected log, correlate related activity by uid, and then validate filters, intelligence matches, or downstream Suricata alerts.

Lab Setup for Proof of Concept¶

In this proof of concept, the Ubuntu host simulated a compromised machine by visiting non-malicious websites, such as testmyids.org and Reddit, with Reddit being treated as malicious to trigger alerts in a safe and controlled environment. To demonstrate Zeek to Suricata integration via PCAP files, Zeek was installed on the same host as Suricata.

Host	OS	Role	IP Address
Fortigate	Fortios 7.6.0	Firewall/Router	192.168.1.111 (WAN) / 10.0.0.1 (LAN)
Suricata	Ubuntu 22.04 LTS	Suricata and Zeek	10.0.0.27

Monitor only authorised traffic

Network logs and packet captures can contain credentials, personal data, and confidential communications. Monitor and inspect only systems and networks you own or are explicitly authorised to test.

Where to go next¶

Install ZeekPrepare the offline Ubuntu sensor. Analyse a PCAPTurn captured traffic into structured logs. Explore ZuiInvestigate Zeek data interactively.