mirror of
https://github.com/zeek/zeek.git
synced 2025-10-01 22:28:20 +00:00
104 lines
No EOL
3.2 KiB
Text
104 lines
No EOL
3.2 KiB
Text
=================================
|
|
The Zeek Network Security Monitor
|
|
=================================
|
|
|
|
Zeek is a powerful framework for network traffic analysis and security
|
|
monitoring. Follow us on Twitter at @zeekurity.
|
|
|
|
Key Features
|
|
============
|
|
|
|
* **In-depth Analysis**
|
|
Zeek ships with analyzers for many protocols, enabling
|
|
high-level semantic analysis at the application layer.
|
|
|
|
* **Adaptable & Flexible**
|
|
Zeek's domain specific scripting language enables site-specific
|
|
monitoring policies and means that it is not restricted to any
|
|
particular detection approach.
|
|
|
|
* **Efficient**
|
|
Zeek targets high-performance networks and is used operationally
|
|
at a variety of large sites.
|
|
|
|
* **Highly Stateful**
|
|
Zeek keeps extensive application-layer state about the network
|
|
it monitors and provides a high-level archive of a network's
|
|
activity.
|
|
|
|
Getting Started
|
|
===============
|
|
|
|
The best place to find information about getting started with Zeek is
|
|
our web site https://www.zeek.org, specifically the documentation
|
|
section there [1]. One the web site you can also get downloads for
|
|
stable releases, tutorials on getting Zeek set up, and many other
|
|
useful resources.
|
|
|
|
You can find release notes in NEWS, and a complete record of all
|
|
changes in CHANGES.
|
|
|
|
To work with the most recent code from the development branch of Zeek,
|
|
clone the master git repository:
|
|
|
|
> git clone --recursive https://github.com/zeek/zeek
|
|
|
|
With all dependencies [2] in place, build and install:
|
|
|
|
> ./configure && make && sudo make install
|
|
|
|
Write your first Zeek script:
|
|
|
|
# File "hello.zeek"
|
|
|
|
event zeek_init()
|
|
{
|
|
print "Hello, World!";
|
|
}
|
|
|
|
And run it:
|
|
|
|
> zeek hello.zeek
|
|
|
|
For learning more about the Zeek scripting language,
|
|
https://try.zeek.org is a great resource.
|
|
|
|
Development
|
|
===========
|
|
|
|
Zeek is developed on GitHub by its community. We welcome
|
|
contributions. Working on an open source project like Zeek can be an
|
|
incredibly rewarding experience and, packet by packet, makes the
|
|
Internet a little safer. Today, as a result of countless
|
|
contributions, Zeek is used operationally around the world by major
|
|
companies and educational and scientific institutions alike for
|
|
securing their cyber infrastructure.
|
|
|
|
If you're interested in getting involved, we collect feature requests
|
|
and issues on GitHub. More information on Zeek's development can be
|
|
found here [2], and information about its community and mailing lists
|
|
(which are fairly active) can be found here [3].
|
|
|
|
License
|
|
-------
|
|
|
|
Zeek comes with a BSD license, allowing for free use with virtually no
|
|
restrictions. You can find it in COPYING.
|
|
|
|
Tooling
|
|
-------
|
|
|
|
We use the following tooling to help discover issues to fix, amongst a number of
|
|
others.
|
|
|
|
- Clang-Tidy [5]
|
|
- Coverity [6]
|
|
- PVS-Studio - static analyzer for C, C++, C#, and Java code [7]
|
|
|
|
[1] https://www.zeek.org/documentation/index.html
|
|
[2] https://docs.zeek.org/en/stable/install/install.html
|
|
[3] https://www.zeek.org/development/index.html
|
|
[4] https://www.zeek.org/community/index.html
|
|
[5] https://clang.llvm.org/extra/clang-tidy/
|
|
[6] https://scan.coverity.com/projects/bro
|
|
[7] https://pvs-studio.com/en/pvs-studio/?utm_source=github&utm_medium=organic&utm_campaign=open_source |