Install zeek with Homebrew, MacPorts, Nix, apt, scoop

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• bifcl
• binpac
• btest
• btest-ask-update
• btest-bg-run
• btest-bg-run-helper
• btest-bg-wait
• btest-diff
• btest-diff-rst
• btest-progress
• btest-rst-cmd
• btest-rst-include
• btest-rst-pipe
• btest-setsid
• capstats
• hilti-config
• hiltic
• paraglob-test
• spicy-build
• spicy-config
• spicy-driver
• spicy-dump
• spicy-precompile-headers
• spicyc
• spicyz
• trace-summary
• zeek
• zeek-archiver
• zeek-client
• zeek-cluster-layout-generator
• zeek-config
• zeek-cut

Project history

Vern Paxson developed the first version of Bro at Lawrence Berkeley National Laboratory in 1995, and Berkeley Lab says it was first deployed there in 1996. Paxson's original research paper on Bro appeared at the 1998 USENIX Security Symposium and later received a Test of Time Award, giving the project unusually strong research roots for an operational security tool.

The project changed its name from Bro to Zeek in 2018. The rename kept the technical lineage while moving away from a name tied to Orwellian surveillance language; the current Zeek site presents the project as a mature open-source network security monitoring tool used across university, national-lab, enterprise, and cloud environments.

Zeek evolved from a research network intrusion detection system into a broad traffic-analysis framework. Its architecture centers on protocol analyzers, an event engine, a domain-specific scripting language, and logs that describe network activity at a semantic level rather than only matching packets against signatures.

Adoption history

Zeek's adoption grew through security operations centers, research networks, incident response teams, and enterprise monitoring programs that needed richer context than firewalls or classic intrusion prevention systems expose. Berkeley Lab notes continued work around 100G monitoring, Science DMZ environments, and the Corelight commercial spinoff.

The current Zeek site presents large adoption signals: worldwide deployments, thousands of tracked network events, many default log types, federally funded R&D history, and hundreds of community-contributed packages. The GitHub README also notes operational use by major companies plus educational and scientific institutions.

Its ecosystem includes community packages, ZeekControl/zeekctl for managing deployments, zkg for package management, and adjacent tools such as Spicy and BinPAC for protocol parsing. That gives Zeek a package ecosystem of its own inside the larger OS package ecosystem.

How it is used

Users run Zeek on packet captures or live network interfaces to produce logs such as connection, DNS, HTTP, TLS, file, software, notice, and weird activity logs. Security teams then send those logs into SIEMs, data lakes, detection pipelines, or manual investigation workflows.

Zeek is scriptable: users write policy scripts and event handlers to add site-specific detection, extraction, enrichment, and logging behavior. Larger deployments use ZeekControl and cluster configuration files to split traffic analysis across workers, proxies, managers, and loggers.

Why package nerds care

Zeek matters to package nerds because it is not just one binary: a Homebrew-style install exposes the analyzer, control tooling, test tooling, package tooling, protocol tooling, and helper commands. It is a full security platform delivered through packages.

It also shows how an academic research system can become durable operational infrastructure. The package carries decades of protocol-analysis practice, a rename, a commercial ecosystem, community packages, and heavy deployment expectations while still remaining installable as an open-source Unix tool.

Timeline

• 1995: Vern Paxson developed the initial Bro Network Security Monitor at Lawrence Berkeley National Laboratory.
• 1996: Bro was first deployed at Berkeley Lab.
• 1998: Paxson's original Bro paper appeared at the USENIX Security Symposium.
• 2018: The Bro project changed its name to Zeek.
• 2022: The original Bro/Zeek paper received a USENIX Test of Time Award.

Related projects

• Corelight: commercial company and product lineage built around Zeek/Bro expertise.
• Spicy: Zeek-adjacent parser/tooling stack shipped with modern Zeek packages.
• BinPAC: protocol analyzer compiler historically associated with Bro/Zeek.
• Suricata and Snort: adjacent network IDS tools often compared with Zeek, though Zeek emphasizes semantic logs and scripting over pure signature blocking.

Sources

• https://docs.zeek.org/en/current/about/what.html - official docs explain what Zeek is and how it differs from traditional IDS tools.
• https://docs.zeek.org/en/current/quickstart.html - official docs cover running Zeek, live traffic, scripting, managing Zeek, and cluster concepts.
• https://github.com/zeek/zeek - README describes Zeek's key features, operational use, scripting, development model, and community.
• https://secpriv.lbl.gov/project/network-security-monitor/ - Berkeley Lab summary gives origin, first deployment, original paper, rename, Corelight spinoff, and Test of Time Award context.
• https://zeek.org/ - project site describes Zeek's current role, rename from Bro, telemetry/logging model, deployment claims, and community package ecosystem.