thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Zeek

An open-source network security monitoring tool that generates detailed logs of network protocol activity.

Definition

Formerly called Bro, Zeek passively analyzes traffic and writes structured logs such as conn.log, dns.log, http.log, ssl.log, files.log and x509.log. Its scripting language enables custom detections. It is widely used for threat hunting and incident investigation.

Example

Searching Zeek dns.log for long TXT queries to detect DNS tunneling.

Exam tip

Zeek produces metadata logs, while Suricata/Snort are primarily signature-based IDS engines.

Related terms