Zeek

No entries match these filters. Clear filters

1. announced Sep 17, 2026 · issue 078

   Zeek 9 ships ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster comms by default, native encapsulated-traffic ingestion, systemdsystemdA Linux init system and service manager, maintained by the systemd project, that starts and supervises processes, manages dependencies between services, and exposes a consistent API for controlling daemons at runtime. orchestration via zeek.conf, and new log fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ TRY IT
   Enable ECH extension logging in ssl.log to capture HPKE KDF and AEAD identifiers from TLS 1.3 Encrypted Client Hello handshakes.
   copy

   $ @load protocols/ssl/ssl-log-ext

   Cap the software framework's detection cache to limit memory use and reduce noisy software-version log churn in high-volume environments.
   /etc/zeek/local.zeek copy

   redef Software::max_software_cache_size = 5000;
   redef Software::parse_cache_interval = 1min;
   redef Software::found_cache_interval = 5min;

   • Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching.
   • Adds ech_kdf_id and ech_aead_id fields to ssl.log (via the protocols/ssl/ssl-log-ext.zeek policy script) reporting HPKE KDF and AEAD identifiers from the TLS 1.3 ECH extension.
   • Adds new ntp_control and ntp_private logs for NTP modes 6 and 7 respectively.
   • Adds a new multicast_participants.log (via the protocols/conn/multicast-participants.zeek policy script) reporting multicast speakers based on IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. activity.

   +14 more show less

   • Adds opcode and opcode_name fields to dns.log to support DNS notifications (RFC 1996); removable via the protocols/dns/disable-opcode-log-fields.zeek policy script.
   • Adds auth_ticket_sha256 and new_ticket_sha256 fields to kerberos.log (via protocols/krb/ticket-logging.zeek) replacing MD5-hashed fields with SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.; the protocols/krb/md5-ticket-logging.zeek policy script restores the original fields.
   • Replaces the host_key fingerprint field in ssh.log with a new host_key_fingerprint field using SHA256 in the same format as ssh-keygen -l; the protocols/ssh/md5-host-key-logging.zeek policy script restores the old field.
   • Switches the default cluster communication backend from Broker to ZeroMQ, enabling direct worker-to-worker eventing, cluster-wide event publishing, and single-point cluster event tapping.
   • Ships a new packet source enabling Zeek clusters to act as a UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. server that ingests encapsulated packet streams directly for cloud environments, without packet-sniffing workarounds.
   • Adds a new ssl_extension_encrypted_client_hello event in the TLS analyzer to report on Encrypted Client Hello (ECH).
   • Adds a new, optional ZIP file analyzer that reports contained files to files.log.
   • Supports TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. in the Syslog analyzer.
   • Logs multicast DNS transactions as separate transactions since they occur on separate network flows.
   • Extends the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer to forward SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. payloads to GSSAPI and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. parsers, enhancing logging into ntlm.log and kerberos.log.
   • Logs FTP sessions that feature only login and logout.
   • Adds the ?as operator to Zeek's scripting language for safely checking type-conversion compatibility at runtime.
   • Adds multiple configuration options for handling binary data in JSON logging, resolving a long-standing ambiguity.
   • Ships Spicy 1.17.0 with a control-flow-graph-based optimizer delivering 20–60% microbenchmark performance improvements and Windows (MSVC) build support.
   • Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching.
   • Adds new ntp_control and ntp_private logs for NTP modes 6 and 7 respectively.
   • Adds a new multicast_participants.log (via the protocols/conn/multicast-participants.zeek policy script) reporting multicast speakers based on IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. activity.
   • Ships a new packet source enabling Zeek clusters to act as a UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. server that ingests encapsulated packet streams directly for cloud environments, without packet-sniffing workarounds.

   +3 more show less

   • Adds a new ssl_extension_encrypted_client_hello event in the TLS analyzer to report on Encrypted Client Hello (ECH).
   • Adds a new, optional ZIP file analyzer that reports contained files to files.log.
   • Adds the ?as operator to Zeek's scripting language for safely checking type-conversion compatibility at runtime.

   11 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The host_key field in ssh.log is replaced by host_key_fingerprint (SHA256, ssh-keygen -l format); any pipeline keying on host_key will break unless the protocols/ssh/md5-host-key-logging.zeek policy script is loaded to restore it.
   • !The auth_ticket and new_ticket fields (MD5 hashes) in kerberos.log are replaced by auth_ticket_sha256 and new_ticket_sha256 (SHA256) via protocols/krb/ticket-logging.zeek; load protocols/krb/md5-ticket-logging.zeek to restore the original fields.
   • !The default cluster communication backend is now ZeroMQ instead of Broker; scripts or packages that rely on Broker-specific eventing must re-enable the Broker backend explicitly.
2. announced Sep 17, 2026 · issue 012

   Zeek 9 ships ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster comms by default, native encapsulated-traffic ingestion, systemdsystemdA Linux init system and service manager, maintained by the systemd project, that starts and supervises processes, manages dependencies between services, and exposes a consistent API for controlling daemons at runtime. orchestration via zeek.conf, and new log fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ TRY IT
   Enable ECH extension logging in ssl.log to capture HPKE KDF and AEAD identifiers from TLS 1.3 Encrypted Client Hello handshakes.
   copy

   $ @load protocols/ssl/ssl-log-ext

   Cap the software framework's detection cache to limit memory use and reduce noisy software-version log churn in high-volume environments.
   /etc/zeek/local.zeek copy

   redef Software::max_software_cache_size = 5000;
   redef Software::parse_cache_interval = 1min;
   redef Software::found_cache_interval = 5min;

   • Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching.
   • Adds ech_kdf_id and ech_aead_id fields to ssl.log (via the protocols/ssl/ssl-log-ext.zeek policy script) reporting HPKE KDF and AEAD identifiers from the TLS 1.3 ECH extension.
   • Adds new ntp_control and ntp_private logs for NTP modes 6 and 7 respectively.
   • Adds a new multicast_participants.log (via the protocols/conn/multicast-participants.zeek policy script) reporting multicast speakers based on IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. activity.

   +14 more show less

   • Adds opcode and opcode_name fields to dns.log to support DNS notifications (RFC 1996); removable via the protocols/dns/disable-opcode-log-fields.zeek policy script.
   • Adds auth_ticket_sha256 and new_ticket_sha256 fields to kerberos.log (via protocols/krb/ticket-logging.zeek) replacing MD5-hashed fields with SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.; the protocols/krb/md5-ticket-logging.zeek policy script restores the original fields.
   • Replaces the host_key fingerprint field in ssh.log with a new host_key_fingerprint field using SHA256 in the same format as ssh-keygen -l; the protocols/ssh/md5-host-key-logging.zeek policy script restores the old field.
   • Switches the default cluster communication backend from Broker to ZeroMQ, enabling direct worker-to-worker eventing, cluster-wide event publishing, and single-point cluster event tapping.
   • Ships a new packet source enabling Zeek clusters to act as a UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. server that ingests encapsulated packet streams directly for cloud environments, without packet-sniffing workarounds.
   • Adds a new ssl_extension_encrypted_client_hello event in the TLS analyzer to report on Encrypted Client Hello (ECH).
   • Adds a new, optional ZIP file analyzer that reports contained files to files.log.
   • Supports TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. in the Syslog analyzer.
   • Logs multicast DNS transactions as separate transactions since they occur on separate network flows.
   • Extends the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer to forward SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. payloads to GSSAPI and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. parsers, enhancing logging into ntlm.log and kerberos.log.
   • Logs FTP sessions that feature only login and logout.
   • Adds the ?as operator to Zeek's scripting language for safely checking type-conversion compatibility at runtime.
   • Adds multiple configuration options for handling binary data in JSON logging, resolving a long-standing ambiguity.
   • Ships Spicy 1.17.0 with a control-flow-graph-based optimizer delivering 20–60% microbenchmark performance improvements and Windows (MSVC) build support.
   • Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching.
   • Adds new ntp_control and ntp_private logs for NTP modes 6 and 7 respectively.
   • Adds a new multicast_participants.log (via the protocols/conn/multicast-participants.zeek policy script) reporting multicast speakers based on IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. activity.
   • Ships a new packet source enabling Zeek clusters to act as a UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. server that ingests encapsulated packet streams directly for cloud environments, without packet-sniffing workarounds.

   +3 more show less

   • Adds a new ssl_extension_encrypted_client_hello event in the TLS analyzer to report on Encrypted Client Hello (ECH).
   • Adds a new, optional ZIP file analyzer that reports contained files to files.log.
   • Adds the ?as operator to Zeek's scripting language for safely checking type-conversion compatibility at runtime.

   11 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The host_key field in ssh.log is replaced by host_key_fingerprint (SHA256, ssh-keygen -l format); any pipeline keying on host_key will break unless the protocols/ssh/md5-host-key-logging.zeek policy script is loaded to restore it.
   • !The auth_ticket and new_ticket fields (MD5 hashes) in kerberos.log are replaced by auth_ticket_sha256 and new_ticket_sha256 (SHA256) via protocols/krb/ticket-logging.zeek; load protocols/krb/md5-ticket-logging.zeek to restore the original fields.
   • !The default cluster communication backend is now ZeroMQ instead of Broker; scripts or packages that rely on Broker-specific eventing must re-enable the Broker backend explicitly.
3. v9.0.0 Aug 21, 2026 · issue 075

   Zeek 9.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packet source for VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments./GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.0.0 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v9.0.0

   └──▷ TRY IT
   Receive VXLAN mirror traffic over UDP on a busy sensor where multiple Zeek workers share the load via kernel SO_REUSEPORT balancing — no raw packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. interface needed.
   copy

   $ zeek -i udp::0.0.0.0:4789:vxlan

   Enable VNI-aware connection tracking so each VXLAN tenant network is tracked separately — load alongside the UDP packet source.
   copy

   $ zeek -i udp::0.0.0.0:4789:vxlan policy/frameworks/conn_key/packet_source/udp/vxlan_vni

   Switch JSON log escaping to TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity.-style (reversible) encoding instead of the default hex encoding, so downstream SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. parsers can round-trip binary fields correctly.
   local.zeek copy

   redef Log::json_string_escape_policy = JSON::STRING_ESCAPE_POLICY_TSV;

   • Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
   • Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.
   • Adds policy/protocols/conn/multicast-participants.zeek producing a new multicast_participants.log with IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address.-derived data about hosts participating in multicast connections.
   • Adds two new NTP logs — ntp_control.log and ntp_private.log — covering NTP modes 6 and 7, which were previously unlogged.

   +19 more show less

   • Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX.
   • Extends zeek.conf and zeek-systemd-generator to support multiple interfaces and multi-host deployments.
   • Adds ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension.
   • Adds ssl_extension_signature_algorithms_cert event raised for the TLS signature_algorithms_cert extension.
   • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. PDUs.
   • Extends the LDAP analyzer to forward SASL payloads from bindRequest/bindResponse to GSSAPI and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. parsers, enriching ntlm.log and kerberos.log.
   • Extends the Syslog analyzer to support TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. via Octet Counting and Non-Transparent-Framing on port 514/tcp.
   • Adds DPD signatures for QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. version 1 and QUIC version 2 to attach the QUIC analyzer on non-port-443 UDP connections on signature match.
   • Adds ?as operator to test whether a value can be safely cast to a target type at script level.
   • Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.
   • Adds $attributes field to script_id records returned by global_ids() BiF, exposing identifier attributes.
   • Extends krb_ap_request() event with an in_kdc_padata parameter to indicate whether the AP-REQ is embedded in KDC/TGS pre-authentication data.
   • Extends kerberos.log AP entries to populate the service and cipher columns, which were previously unset.
   • Extends the known-certs, known-hosts, and known-services scripts with storage-framework options including enable_hosts_persistence, host_store_prefix, host_store_backend_type, and host_store_backend_options (SQLite backend under Cluster::default_store_dir by default).
   • Extends the HTTP analyzer with nine new weirds — HTTP_bad_chunk_size, HTTP_chunked_multi, HTTP_content_length_0_and_expect_100_cont, HTTP_content_length_leading_zeros, HTTP_bad_content_length, HTTP_obsolete_line_folding, HTTP_content_length_and_chunked, HTTP_content_range_and_chunked, and HTTP_expect_not_100_continue — for unusual Content-Length, Transfer-Encoding, and Expect header usage.
   • Extends the Input Framework to read pattern values with case-insensitive (/foo/i) and single-line (/bar/s) modifiers.
   • Extends the as casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions.
   • Makes OpaqueType non-final and adds hooks for hashing, casting, and default initialization, enabling plugins to introduce new scripting types storable in sets/tables and castable to existing Zeek types (experimental).
   • Splits zeromq/main.zeek options into a separate zeromq/options.zeek file to allow standalone Zeek processes to connect to the ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. layer without participating in cluster node events.
   • Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
   • Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.
   • Adds policy/protocols/conn/multicast-participants.zeek producing a new multicast_participants.log with IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address.-derived data about hosts participating in multicast connections.
   • Adds two new NTP logs — ntp_control.log and ntp_private.log — covering NTP modes 6 and 7, which were previously unlogged.

   +6 more show less

   • Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX.
   • Adds ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension.
   • Adds ssl_extension_signature_algorithms_cert event raised for the TLS signature_algorithms_cert extension.
   • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. PDUs.
   • Adds ?as operator to test whether a value can be safely cast to a target type at script level.
   • Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.

   13 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Broker's legacy embedded WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server is fully removed: Broker::BrokerProtocol, Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy no longer exist. Use Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead.
   • !The BrokerProtocol enum has been removed and the Broker manager's Listen() C++ method no longer accepts its optional BrokerProtocol argument; it always uses Broker's native protocol.
   • !Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format().
   • !The ZeekJS plugin now requires std::format from C++20, dropping support for older distributions using GCC 12.x such as Debian 12.
   • !FreeBSD is no longer officially supported with CI testing; it moves to the same community-patch model as OpenBSD.
4. v9.0.0 Aug 21, 2026 · issue 012

   Zeek 9.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packet source for VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments./GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.0.0 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v9.0.0

   └──▷ TRY IT
   Receive VXLAN mirror traffic over UDP on a busy sensor where multiple Zeek workers share the load via kernel SO_REUSEPORT balancing — no raw packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. interface needed.
   copy

   $ zeek -i udp::0.0.0.0:4789:vxlan

   Enable VNI-aware connection tracking so each VXLAN tenant network is tracked separately — load alongside the UDP packet source.
   copy

   $ zeek -i udp::0.0.0.0:4789:vxlan policy/frameworks/conn_key/packet_source/udp/vxlan_vni

   Switch JSON log escaping to TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity.-style (reversible) encoding instead of the default hex encoding, so downstream SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. parsers can round-trip binary fields correctly.
   local.zeek copy

   redef Log::json_string_escape_policy = JSON::STRING_ESCAPE_POLICY_TSV;

   • Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
   • Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.
   • Adds policy/protocols/conn/multicast-participants.zeek producing a new multicast_participants.log with IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address.-derived data about hosts participating in multicast connections.
   • Adds two new NTP logs — ntp_control.log and ntp_private.log — covering NTP modes 6 and 7, which were previously unlogged.

   +19 more show less

   • Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX.
   • Extends zeek.conf and zeek-systemd-generator to support multiple interfaces and multi-host deployments.
   • Adds ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension.
   • Adds ssl_extension_signature_algorithms_cert event raised for the TLS signature_algorithms_cert extension.
   • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. PDUs.
   • Extends the LDAP analyzer to forward SASL payloads from bindRequest/bindResponse to GSSAPI and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. parsers, enriching ntlm.log and kerberos.log.
   • Extends the Syslog analyzer to support TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. via Octet Counting and Non-Transparent-Framing on port 514/tcp.
   • Adds DPD signatures for QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. version 1 and QUIC version 2 to attach the QUIC analyzer on non-port-443 UDP connections on signature match.
   • Adds ?as operator to test whether a value can be safely cast to a target type at script level.
   • Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.
   • Adds $attributes field to script_id records returned by global_ids() BiF, exposing identifier attributes.
   • Extends krb_ap_request() event with an in_kdc_padata parameter to indicate whether the AP-REQ is embedded in KDC/TGS pre-authentication data.
   • Extends kerberos.log AP entries to populate the service and cipher columns, which were previously unset.
   • Extends the known-certs, known-hosts, and known-services scripts with storage-framework options including enable_hosts_persistence, host_store_prefix, host_store_backend_type, and host_store_backend_options (SQLite backend under Cluster::default_store_dir by default).
   • Extends the HTTP analyzer with nine new weirds — HTTP_bad_chunk_size, HTTP_chunked_multi, HTTP_content_length_0_and_expect_100_cont, HTTP_content_length_leading_zeros, HTTP_bad_content_length, HTTP_obsolete_line_folding, HTTP_content_length_and_chunked, HTTP_content_range_and_chunked, and HTTP_expect_not_100_continue — for unusual Content-Length, Transfer-Encoding, and Expect header usage.
   • Extends the Input Framework to read pattern values with case-insensitive (/foo/i) and single-line (/bar/s) modifiers.
   • Extends the as casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions.
   • Makes OpaqueType non-final and adds hooks for hashing, casting, and default initialization, enabling plugins to introduce new scripting types storable in sets/tables and castable to existing Zeek types (experimental).
   • Splits zeromq/main.zeek options into a separate zeromq/options.zeek file to allow standalone Zeek processes to connect to the ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. layer without participating in cluster node events.
   • Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
   • Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.
   • Adds policy/protocols/conn/multicast-participants.zeek producing a new multicast_participants.log with IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address.-derived data about hosts participating in multicast connections.
   • Adds two new NTP logs — ntp_control.log and ntp_private.log — covering NTP modes 6 and 7, which were previously unlogged.

   +6 more show less

   • Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX.
   • Adds ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension.
   • Adds ssl_extension_signature_algorithms_cert event raised for the TLS signature_algorithms_cert extension.
   • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. PDUs.
   • Adds ?as operator to test whether a value can be safely cast to a target type at script level.
   • Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.

   13 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Broker's legacy embedded WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server is fully removed: Broker::BrokerProtocol, Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy no longer exist. Use Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead.
   • !The BrokerProtocol enum has been removed and the Broker manager's Listen() C++ method no longer accepts its optional BrokerProtocol argument; it always uses Broker's native protocol.
   • !Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format().
   • !The ZeekJS plugin now requires std::format from C++20, dropping support for older distributions using GCC 12.x such as Debian 12.
   • !FreeBSD is no longer officially supported with CI testing; it moves to the same community-patch model as OpenBSD.
5. v8.0.9 Jul 10, 2026 · release notes

   Zeek v8.0.9 adds new script constants and weirds for NVT, Rlogin, RSH, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., Finger, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., Gnutella, SSH, and HTTP analyzers to cap resource usage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v8.0.9 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v8.0.9

   • Adds Finger::max_line_length script constant to limit input line size in the Spicy Finger analyzer.
   • Adds rpc_max_pending_calls script constant and rpc_discarded_pending_calls event to control pending calls in the RDP analyzer.
   • Adds Gnutella::max_line_length and Gnutella::max_header_length script constants to limit data size in the Gnutella analyzer.
   • Adds SSH::max_packet_length and SSH::max_string_length script constants to control maximum SSH packet and string sizes.
   • Adds TCP_scale_range weird for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. window scale limits exceeding RFC7323.

   +1 more show less

   • Adds new weirds for HTTP Content-Range violations including HTTP_content_range_cannot_parse, HTTP_non_positive_content_range, and HTTP_content_range_invalid_instance.

   6 details in Everything

6. v8.2.1 Jul 10, 2026 · release notes

   Zeek v8.2.1 introduces configurable limits and new weirds for NVT, Spicy WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., Finger, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., Gnutella, SSH, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. analyzers

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v8.2.1 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v8.2.1

   • Adds Finger::max_line_length script constant to control maximum line length in the Finger analyzer.
   • Adds rpc_max_pending_calls script constant and rpc_discarded_pending_calls event for the RDP analyzer.
   • Adds Gnutella::max_line_length and Gnutella::max_header_length script constants to limit data size in the Gnutella analyzer.
   • Adds SSH::max_packet_length and SSH::max_string_length script constants to control maximum packet and string sizes in the SSH analyzer.
   • Adds TCP_scale_range weird logging when the TCP window scale exceeds the RFC7323 limit of 14 bytes.

   +2 more show less

   • Adds new weirds for Content-Length, Transfer-Encoding, and Expect header violations in the HTTP analyzer.
   • Adds five new weirds for ICMPv6 packet parsing evasion cases.

   7 details in Everything

7. v8.0.8 May 12, 2026 · release notes

   Zeek v8.0.8 adds MIME header size cap with new variable and weird to mitigate DoS via crafted SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure./HTTP packets.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v8.0.8 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v8.0.8

   • Adds MIME::max_header_bytes script variable to cap the maximum size of a MIME header, limiting memory exhaustion from crafted SMTP or HTTP packets.
   • Adds exceeded_mime_max_header_bytes weird reported when a MIME header exceeds the configured byte limit, halting further processing of that packet.

   2 details in Everything

8. v8.2.0 May 12, 2026 · release notes

   Zeek v8.2.0 adds ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. CURVE encryption, IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. analyzer, &publish_on_change for cluster tables, and configurable analyzer ports.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v8.2.0 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v8.2.0

   └──▷ USE IT
   Publish only newly-added entries from a cluster-shared set to all nodes without Broker, replacing &broker_store.
   zeek copy

   global endpoints: set[addr, addr] &write_expire=5min &publish_on_change=[
       changes=set(TABLE_ELEMENT_NEW),
   ];

   Generate a Z85 CURVE keypair for encrypted ZeroMQ cluster communication and inspect it.
   copy

   $ zeek -e 'print to_json(Cluster::Backend::ZeroMQ::generate_keypair())' | jq

   Add a non-standard port to the HTTP analyzer so Zeek detects HTTP on port 8181 without recompiling.
   zeek copy

   # In a local.zeek or site script:
   redef HTTP::ports += { 8181/tcp };

   • New &publish_on_change attribute for global tables and sets enables efficient publishing of selected table changes as remote events to a configurable cluster topic, replacing deprecated Broker-specific sync attributes.
   • ZeroMQ cluster communication now supports CURVE encryption; keys auto-generated by ZeekControl when a multi-node cluster is detected, or manually configured via cluster_backend_zeromq.use_curve_encryption.
   • ZeroMQ XPUB/XSUB proxy metrics (zeek_cluster_zeromq_proxy_{frontend,backend}_{bytes,messages}_{sent,received}) are now exposed for cluster traffic monitoring.
   • Well-known ports for built-in analyzers are now configurable via redef, e.g. redef HTTP::ports += { 8181/tcp }.
   • New IGMP analyzer adds events for each IGMP message type.

   +8 more show less

   • The dns.log now records DNS notifications (RFC 1996) with opcode 4 and opcode_code notify.
   • The @load directive now supports loading shared object (.so) files directly, enabling alternative plugin layouts without ZEEK_PLUGIN_PATH discovery.
   • New connection_timing_out hook allows scripts to prevent Zeek from timing out a specific connection, useful for keeping shunted connections alive.
   • New modulo BiF added, with different behavior from % for negative numbers.
   • The &on_change attribute for tables and sets now accepts variable-argument functions.
   • Windows support substantially improved; btest suite now runs on CI and the majority of tests pass.
   • X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. parsing now supports additional key types (e.g. ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code.) for certificate key length and key_type fields.
   • SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. analyzer now forwards the first gap encountered during RFC 822 message analysis to the file object, enabling gap detection via missing_bytes in files.log.

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The minimum version requirement for ZeroMQ is now 4.3.0; older ZeroMQ installations will no longer work.
   • !Enums are now nominally typed; scripts mixing incompatible enum types (e.g. color and city) will produce warnings now and errors in v9.1.
   • !The BifEnum namespace was moved into the zeek namespace; scripts or plugins referencing BifEnum:: directly will break.
   • !The MetricsAddress default in zeekctl.cfg changed from 0.0.0.0 to 127.0.0.1; remote Prometheus scrapers or containerized deployments must now explicitly set MetricsAddress = 0.0.0.0 in zeekctl.cfg.
   • !btest Traces library packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. now use .pcap/.pcapng suffixes; plugins referencing the old .trace suffix will break.
   • !The public vlan and inner_vlan C++ Packet members changed from uint32_t to an optional VlanTag struct; the dei and pcp members were removed and merged into VlanTag. C++ plugins accessing these fields must be updated (access via packet.vlan->id after checking the optional).
   • !ASCII control characters < 32 in JSON strings are now escaped as \xXX again (reverted from the \u00XX style introduced in Zeek 8.1); consumers relying on the \u00XX encoding from 8.1 will see changed output.
   • !FreeBSD is no longer an officially-supported platform; regular CI builds on FreeBSD have been dropped.
9. v8.1.0 Dec 15, 2025 · release notes

   Zeek v8.1.0 adds log length truncation vars, SHA-224/384/512 hashes, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. discarded packet events, and systemd generator.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v8.1.0 https://github.com/zeek/zeek.git
   # already have the repo? check out this version:
   $ git checkout v8.1.0

   └──▷ HOW TO FIND IT
   Monitor QUIC connections that are being dropped due to protocol violations.
   📍cat <<'EOF' | zeek -C event QUIC::discarded_packet(c: connection) { print fmt("Discarded packet in %s", c$id$orig_h); } @load base EOF
   • Adds Log::default_max_field_string_bytes and three other log truncation variables to control maximum string and container lengths in output
   • Adds SHA-224, SHA384, and SHA512 hash BiFs (sha224_hash, sha384_hash, sha512_hash and their init/update/finish counterparts)
   • Adds QUIC::discarded_packet event for packets with fixed_bit 0, controllable via QUIC::max_discarded_packet_events
   • Adds zeek-systemd-generator executable and /etc/zeek/zeek.conf for opinionated single-node cluster deployment on Linux

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !ClusterBackend in zeekctl.cfg now defaults to ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker.; existing Broker users must set ClusterBackend = Broker and run zeekctl deploy.
   • !Python 3.10 is now required for Zeek.
10. 8.1.0 Dec 15, 2025 · release notes

    Zeek 8.1.0 adds LogAnalyzer field-length controls, new hooks, and macOS ZeekJS support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 8.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout 8.1.0

    • Adds the ability to control the maximum length of strings and containers in log output fields via Log::set_field_max_length() or similar config keys.
    • Adds TapAnalyzer class allowing scripts to tap into all packets delivered to child analyzers attached to session adapters.
    • Adds two new hooks Cluster::on_subscribe() and Cluster::on_unsubscribe() to observe subscription events on cluster backends.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default cluster backend for standalone zeek invocations changed from Broker to No-op (Cluster::CLUSTER_BACKEND_NONE).
    • !Zeek now requires Python 3.10 or later; older versions will fail to run.
    • !The &backend and &broker_store script attributes now cause startup errors if used with a non-Broker cluster backend.
11. v8.0.3 Oct 15, 2025 · release notes

    Zeek v8.0.3 adds tls_options_websocket for TLS configuration on the management controller's WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.0.3 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v8.0.3

12. v8.0.1 Aug 26, 2025 · release notes

    Zeek v8.0.1 adds a new Zeekctl MetricsAddr option and moves official Docker images to Debian 13 (trixie).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.0.1 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v8.0.1

    └──▷ USE IT
    Override the Prometheus telemetry listener address in Zeekctl so it binds to a specific interface instead of all interfaces.
    ini copy

    # In zeekctl.cfg:
    MetricsAddr = 192.168.1.10

    • Adds MetricsAddr option in Zeekctl to override the address the telemetry framework uses when communicating with Prometheus (defaults to 0.0.0.0).
    • Official Zeek Docker images are now based on Debian 13.0 (trixie).

    2 details in Everything

13. v8.0.0 Aug 12, 2025 · release notes

    Zeek 8.0 adds pluggable connection tracking, Redis analyzer, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. .eml extraction, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster support, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v8.0.0

    └──▷ TRY IT
    Enable VLAN-aware connection tracking so that connections on different VLANs are tracked separately, with VLAN tags logged as id.ctx.vlan and id.ctx.inner_vlan.
    copy

    $ @load frameworks/conn_key/vlan_fivetuple

    Extract raw emails as .eml files from SMTP traffic for offline analysis or malware triage.
    copy

    $ redef SMTP::enable_rfc822_msg_file_analysis = T;
    
    event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) {
        if ( f$id == c$smtp$rfc822_msg_fuid )
            Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename="email"]);
    }

    Switch a ZeekControl-managed cluster to the ZeroMQ backend with WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. support so zeekctl print and netstats work without the Broker protocol.
    ini copy

    ClusterBackend = ZeroMQ
    UseWebSocket = 1

    • Adds pluggable, customizable connection tracking with a built-in VLAN-aware five-tuple implementation (frameworks/conn_key/vlan_fivetuple).
    • Adds ZeroMQ cluster backend support in ZeekControl via ClusterBackend = ZeroMQ and UseWebSocket = 1 in zeekctl.cfg.
    • Adds configurable cluster telemetry with per-event, per-topic, and histogram metrics via Cluster::core_metrics and Cluster::websocket_metrics.
    • Adds X-Application-Name HTTP header support on the WebSocket API (v1/messages/json) for per-application cluster event metrics.
    • Adds Redis protocol analyzer (from spicy-redis) enabled by default, logging commands and replies to redis.log.

    +4 more show less

    • Adds SMTP RFC 822 message forwarding to the file analysis framework, enabling .eml extraction from SMTP traffic.
    • Adds a generic EventMetadata module with current() and current_all() functions for accessing per-event metadata.
    • Adds new HookPublishEvent() plugin hook for intercepting, monitoring, modifying, or rerouting published cluster events.
    • Adds explicit TLS support (AUTH TLS) to the FTP analyzer.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zeek now requires the ZeroMQ library (libzmq5, libzmq3-dev, cppzmq-dev) to build and run.
    • !Building Zeek now requires a C++20-capable compiler (GCC 10+, Clang 8+, or Visual Studio 2022+).
    • !The zeek::Span class is deprecated; telemetry subsystem APIs now use std::span — plugins using zeek::Span for counter/gauge instantiation need updates.
    • !Broad #include cleanup across the codebase may break third-party plugin builds.
    • !lookup_connection() and connection_exists() now strictly require a conn_id instance; duck-typed conn_id-like records are no longer accepted.
    • !Network timestamps are no longer added to events by default; re-enable with redef EventMetadata::add_network_timestamp = T;.
    • !The ASCII writer's JSON::TS_MILLIS format now produces signed integers for pre-epoch timestamps; revert with redef LogAscii::json_timestamps = JSON::TS_MILLIS_UNSIGNED;.
    • !The endpoint label in Prometheus and telemetry.log metrics is renamed to node; revert with redef Telemetry::metrics_endpoint_label = "endpoint";.
    • !current_event_time(), Event::Time(), and EventMgr::CurrentEventTime() now return -1.0 (instead of 0.0 or a stale timestamp) when no timestamp metadata is available.
    • !Missing network timestamp metadata on remote events is no longer silently set to local network time; re-enable with redef EventMetadata::add_missing_remote_network_timestamp = T;.
    • !The IsPacketSource() method on IOSource has been removed.
    • !The --with-binpac and --with-bifcl configure arguments are deprecated and may break cross-compilation workflows.
    • !The ssl_session_ticket_handshake event payload no longer includes the two extra leading bytes that preceded the session ticket data; scripts that worked around this must be updated.
14. v7.2.2 Jul 21, 2025 · release notes

    Zeek v7.2.2 adds a configurable max log record size with a new weird and metric to guard against DoS via oversized log entries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.2.2 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.2.2

    └──▷ USE IT
    Cap log record size network-wide to reduce DoS risk from crafted packets that produce abnormally large log entries.
    zeek copy

    redef Log::max_log_record_size = 1000000;

    • New Log::max_log_record_size redefinable constant lets operators cap the size of individual log records to limit DoS exposure from oversized entries.
    • New log-writer-discarded-writes metric tracks how often log entries are dropped due to the size limit, enabling operational monitoring of the control.

    2 details in Everything

15. v7.0.9 Jul 21, 2025 · release notes

    Zeek v7.0.9 adds a configurable max log record size limit with a new weird and metric to guard against DoS via oversized records.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.0.9 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.0.9

    └──▷ TRY IT
    Cap log record size to protect against remote DoS via oversized records and surface violations as a weird in notice logs.
    copy

    $ zeek -r <capture.pcap> Log::max_log_record_size=1000000

    • New Log::max_log_record_size redefinable constant lets operators cap the size of individual log records to prevent memory overflow from crafted packets.
    • New log_record_too_large weird is raised whenever a log entry exceeds the configured size limit, enabling detection and alerting.
    • New log-writer-discarded-writes metric tracks how often log entries are dropped due to exceeding the size limit.

    3 details in Everything

16. v7.2.0 Apr 25, 2025 · release notes

    Zeek v7.2.0 adds a new Storage framework (SQLite/Redis), Cluster WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. API, Geneve tunnel extraction, and expanded Broker metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.2.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.2.0

    └──▷ TRY IT
    Track which protocol analyzers failed per connection by loading the new failed-service policy script, adding failed_service to connection.log.
    copy

    $ zeek -C -r trace.pcap @load protocols/conn/failed-service-logging

    • Adds a new Storage framework with SQLite and Redis backends, replacing Broker-based storage; supports async (Storage::Async) and sync (Storage::Sync) modes and cluster environments.
    • Adds Cluster::listen_websocket() to expose WebSocket connectivity across any cluster backend, with new Cluster::websocket_client_added() and Cluster::websocket_client_lost() events.
    • Adds PacketAnalyzer::Geneve::get_options() builtin to extract Geneve tunnel options from the current packet in scripts.
    • Adds is_valid_subnet() function mirroring is_valid_ip() for subnet validation.
    • Adds a new enc_part field to KRB_Response (passed in krb_as_response), exposing the cipher and encrypted session data from KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. AS responses.

    +15 more show less

    • Adds three new Broker peer buffer metrics: zeek_broker_peer_buffer_messages, zeek_broker_peer_buffer_recent_max_messages, and zeek_broker_peer_buffer_overflows_total for per-peer send buffer health monitoring.
    • Adds Broker::log_severity_level and Broker::log_stderr_severity_level options to control propagation of Broker log messages as Zeek events into broker.log.
    • Adds DPD::track_removed_services_in_connection option and a new protocols/conn/failed-service-logging.zeek policy script that adds a failed_service column to connection.log.
    • Adds a warning when scripts declare DNS events that are suppressed by dns_skip_all_addl being set to true.
    • Enables types to be used directly as constants in Zeek script, allowing types to be passed into BIFs without aliasing.
    • Emits a new lowercase_HTTP_keyword weird when the HTTP analyzer encounters a non-uppercase HTTP-name field.
    • Adds the ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster backend (introduced in 7.1) with correctness, performance, and robustness improvements; loadable via @load frameworks/cluster/backend/zeromq/connect.
    • Enables comparison of pattern-containing vectors with == and != in scripts.
    • Populates the ip_proto field for connections encapsulated in tunnels.
    • Expands Site::private_address_space with additional non-routable subnets from RFCs 2365, 3058, 3879, and 5771.
    • Enables --save-seeds to put Zeek into deterministic mode, producing identical UIDs on a subsequent --load-seeds run.
    • Adds DNS::skip_resp_host_port_pairs option to detect-external-names.zeek; the script now also logs IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. results.
    • Includes ZeekJS documentation in the main Zeek docs at docs.zeek.org by default.
    • Enables libkrb5 support on all platforms (previously Linux-only).
    • The to_count() and to_int() built-in functions now trim trailing spaces from their argument.

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !is_remote_event(), current_analyzer(), and current_event_time() (and their C++ EventMgr counterparts) now return false, 0, or zero time (instead of the previous event's values) when event draining has completed.
    • !to_int() now returns an error on invalid input instead of silently returning 0, matching the behavior of to_count().
    • !Cluster::listen_websocket() has TLS disabled by default, whereas Broker::listen_websocket() defaulted to TLS enabled — switching will disable TLS unless a WebSocketTLSOptions record is passed or a TLS reverse proxy is used.
    • !Site::private_address_space now includes 239.0.0.0/8, 224.0.0.0/24, [2002:e000::]/40, [2002:ef00::]/24, and [fec0::]/10, which may cause traffic previously considered non-local to be treated as local.
    • !A protocol analyzer that raises a violation before confirmation is now immediately disabled; DPD::max_violations is no longer used (deprecated until Zeek 8.1).
17. v7.1.0 Dec 16, 2024 · release notes

    Zeek v7.1.0 adds PostgreSQL & StreamEvent analyzers, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster backend, and per-peer Broker backpressure controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.1.0

    └──▷ TRY IT
    Disable the new PostgreSQL analyzer if it causes high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. in environments with heavy PostgreSQL traffic until it stabilizes.
    copy

    $ echo 'redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_POSTGRESQL };' >> local.zeek

    Switch a cluster node to the experimental ZeroMQ backend and tune per-peer Broker buffer overflow policy for remaining Broker peers.
    copy

    $ @load frameworks/cluster/backend/zeromq/connect
    # Or, to keep Broker but tune backpressure:
    redef Broker::peer_buffer_size = 4096;
    redef Broker::peer_overflow_policy = "drop_oldest";

    • Adds a PostgreSQL protocol analyzer enabled by default, generating postgresql.log with associated events.
    • Adds a StreamEvent pseudo protocol analyzer that exposes raw TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream data to the scripting layer via the new stream_deliver() event.
    • Adds an experimental ZeroMQ-based cluster backend as a drop-in alternative to Broker publish-subscribe.
    • Adds new Cluster::publish(), Cluster::subscribe(), and Cluster::unsubscribe() functions that operate on whichever cluster backend is enabled.
    • Logs previously invisible IP connections using unknown IP protocols (e.g. not TCP/UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./ICMP) in conn.log with a new ip_proto column; optional ip_proto_name column available via policy script.

    +16 more show less

    • Adds per-peer Broker I/O buffer management with configurable overflow policies (disconnect, drop_newest, drop_oldest) and new tunables peer_buffer_size, peer_overflow_policy, web_socket_buffer_size, and web_socket_overflow_policy.
    • Adds backpressure disconnect telemetry via the new zeek_broker_backpressure_disconnects_total labeled counter metric.
    • Adds StartTLS support to the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer, enabling SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection for connections negotiated via extended request/response.
    • Extends the LDAP analyzer to handle non-sealed GSS-API WRAP tokens.
    • Adds support for TKEY resource records (RFC 2390) to the DNS analyzer, with a new dns_TKEY event.
    • Adds a new DNS_unknown_opcode weird to report unrecognized DNS opcodes.
    • Extends the unknown_protocols() event and unknown_protocol.log to include the names of all packet analyzers used for processing.
    • Adds a mysql_user_change() event to the MySQL analyzer when a user changes mid-session via COM_USER_CHANGE.
    • Extends signature_match() and custom signature events with an optional end_of_match parameter indicating the end-of-match offset within data.
    • Adds a new InitPreExecution() plugin hook for ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. introspection after ZAM optimizations, executing before zeek_init() is enqueued.
    • Adds SQLite journal mode and synchronous mode configuration to the SQLite logger, including WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. mode support via LogSQLite::journal_mode.
    • Adds experimental support for pluggable cluster backends and pluggable serialization formats for events and log-writes.
    • Ships an experimental Spicy-based SSL/TLS analyzer (disabled by default), enabling full SSL/TLS parsing via --enable-spicy-ssl.
    • Exposes the majority of stats.log metrics through the Telemetry framework and Prometheus output.
    • Adds Log::flush_interval and Log::write_buffer_size options to control batching and flushing for local log writers.
    • FTP PASS command logging in ftp.log now honors FTP::default_capture_password, blanking passwords with <hidden>.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The OpaqueVal::DoSerialize and OpaqueVal::DoUnserialize methods have been removed; plugins overriding them will fail to compile and must be updated to override OpaqueVal::DoSerializeData and OpaqueVal::DoUnserializeData instead.
    • !Internal broker and logging class methods now accept std::vector<threading::Value> instead of threading::Value**; plugins using these internal methods (not DoWrite()/HookLogWrite()) must be updated.
    • !Func::Name() is deprecated; use Func::GetName() instead.
18. v7.0.1 Sep 3, 2024 · release notes

    Zeek v7.0.1 adds StartTLS support to the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer and improves GSS-API WRAP token handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.0.1 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.0.1

    • Adds StartTLS support to the LDAP analyzer, enabling the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. analyzer for connections that negotiate TLS via the extended request/response mechanism.
    • Supports handling of non-sealed GSS-API WRAP tokens in the LDAP analyzer.

    2 details in Everything

19. v7.0.0 Jul 11, 2024 · release notes

    Zeek v7.0 adds table/set/vector delete, can_load() helper, SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic. PDU parsing, and Prometheus telemetry framework

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v7.0.0

    └──▷ USE IT
    Clear a vector without recreating it to avoid allocation overhead in tight loops.
    text copy

    global v = vector(1, 2, 3);
    delete v;

    Conditionally load a script package only if it is present in the Zeek path to prevent errors on minimal installations.
    text copy

    @if ( can_load("my-package") )
    @load my-package
    @endif

    Disable an HTTP analyzer for a specific connection at establishment time using its numeric identifier.
    text copy

    event connection_established(c: connection):
      {
      local aid = lookup_connection_analyzer_id(c$id, Analyzer::ANALYZER_HTTP);
      if ( aid > 0 )
        disable_analyzer(c$id, aid, T, T);
      }

    • delete statement now clears the contents of tables, sets, and vectors.
    • New can_load() helper function backed by bif find_in_zeekpath() allows guarding @load directives when script packages may or may not be installed.
    • Packagers can include a local addition into Zeek's version string via build flag --localversion=XXX and the LOCALVERSION environment variable for Docker builds.
    • SMB2 packets containing multiple PDUs now correctly parse all headers.
    • New built-in function lookup_connection_analyzer_id() retrieves the numeric identifier of an analyzer associated with a connection, enabling use of disable_analyzer() outside of confirmation/violation events.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Telemetry framework moved to a Prometheus-first model; Broker::metrics_port is now Telemetry::metrics_port and Broker::metrics_export_endpoint_name is now Telemetry::metrics_endpoint_name.
    • !Options Broker::metrics_export_interval, Broker::metrics_export_topic, Broker::metrics_import_topics, and Broker::metrics_export_prefixes have been removed.
    • !The unit field has been removed from the telemetry log.
    • !All BROKER_METRICS_* environment variables have been removed.
    • !Cluster configuration requires a new metrics_port field in each node's node.cfg options and the cluster layout record defined in cluster-layout.zeek.
    • !Instruments no longer support count or int64_t; only double versions are provided.
    • !The is_sum argument has been removed from the constructors/creation methods for all instruments.
20. v6.2.1 May 16, 2024 · release notes

    Zeek v6.2.1 adds PacketFilter remove_exclude and --localversion configure flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.2.1 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.2.1

    └──▷ USE IT
    Dynamically remove a named exclusion from a PacketFilter during runtime.
    text copy

    filter::remove_exclude('my_exclude_rule')

    Customize the version string reported by Zeek for tracking specific deployments.
    copy

    $ ./configure --localversion='custom-build-1'

    • PacketFilter now includes remove_exclude function for removing filters by name
    • configure script supports --localversion to customize the version string output

    2 details in Everything

21. v6.0.4 May 16, 2024 · release notes

    Zeek v6.0.4 introduces remove_exclude in PacketFilter and --localversion configure flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.4 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.0.4

    └──▷ USE IT
    Dynamically remove a named packet filter exclusion within a Zeek script without restarting or reloading entirely.
    zeek copy

    PacketFilter::remove_exclude("my_filter_name")

    Build Zeek with a custom version string for internal tracking or identification.
    shell copy

    ./configure --localversion="-internal-build-123"

    • Adds remove_exclude(name) function to the PacketFilter framework to remove a previously added exclude filter by name
    • Adds --localversion option to the configure script to append custom strings to the version reported by zeek -v

    2 details in Everything

22. v6.2.0 Feb 20, 2024 · release notes

    Zeek v6.2.0 adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. analyzer with websocket.log, Log::delay() for deferred logging, and parallel pattern matching tables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.2.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.2.0

    └──▷ HOW TO FIND IT
    Defer a log entry for 2 seconds while querying an external API for enrichment data.
    📍Log::delay(2.0); // ... query external API ... Log::delay_finish()
    Disable the new WebSocket analyzer if it causes unexpected resource usage.
    📍redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_WEBSOCKET };
    • Adds the websocket.log and new Analyzer::ANALYZER_WEBSOCKET to detect and analyze WebSocket traffic
    • Introduces Log::delay() and Log::delay_finish() functions to defer log record writes
    • Extends table types to allow parallel regular expression matching when the index is a pattern
    • Adds Intel::seen_policy hook to intercept and modify Intel framework behavior
    • Adds NetControl::rule_added_policy hook for post-addition NetControl rule modification

    +1 more show less

    • Makes MaxMind database paths configurable via mmdb_city_db, mmdb_country_db, mmdb_asn_db and the fallback path via mmdb_dir_fallbacks

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The arguments, diagnostic_messages, objects, opcodes, and results fields in ldap.log are renamed to their singular forms (argument, diagnostic_message, object, opcode, result) and changed from vectors/sets to scalars
    • !The base_objects, derefs, diagnostic_messages, results, and scopes fields in ldap_search.log are renamed to their singular forms (base_object, deref_aliases, diagnostic_message, result, scope) and changed from vectors/sets to scalars
    • !Zeek's OPENSSL_INCLUDE_DIR is not automatically added to an external plugin's include path anymore
23. v6.0.3 Jan 22, 2024 · release notes

    Zeek v6.0.3 adds MIME::max_depth config to limit parser depth and fixes Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe./Ed448 DNS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.3 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.0.3

    • Adds MIME::max_depth configuration option to limit nested MIME entity parsing depth, generating an exceeded_mime_max_depth weird event when the limit is reached.
    • Updates DNS analyzer to understand Ed25519 and Ed448 signature algorithms for record validation.

    2 details in Everything

24. v6.0.2 Oct 27, 2023 · release notes

    v6.0.2 adds SSL::max_alerts_per_record and SSL::max_ssl_history_length to cap SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. DoS risks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.2 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.0.2

    • Adds SSL::max_alerts_per_record config option to cap alerts per SSL record (default 1 for TLS 1.3, configurable otherwise).
    • Adds SSL::max_ssl_history_length config option to cap ssl.log history field length (default 100 characters).

    2 details in Everything

25. v6.1.0 Oct 13, 2023 · release notes

    Zeek v6.1.0 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. protocol analyzers, new assert statement, &default_insert table attribute, and PcapPcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. buffer sizing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.1.0

    └──▷ USE IT
    Disable the new default LDAP analyzer if high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. consumption occurs.
    text copy

    redef Analyzer::disabled_analyzers += {
    	Analyzer::ANALYZER_LDAP_UDP,
    	Analyzer::ANALYZER_LDAP_TCP,
    };

    Use the new assert statement to validate input data in a script.
    text copy

    assert (input_field > 0, "Input field must be positive");

    Prevent unbounded state growth in HTTP requests by lowering the pending limit.
    text copy

    redef HTTP::max_pending_requests = 50;

    • Adds the LDAP protocol analyzer (analyzes LDAP_UDP and LDAP_TCP, logs to ldap.log and ldap_search.log).
    • Adds the QUIC protocol analyzer for decrypting INITIAL packets of QUIC version 1, forwarding handshake data to SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination..
    • Introduces a new assert <expr: bool>[, <message: string>] statement with assertion_failure() and assertion_result() hooks for runtime assertions.
    • Adds the &default_insert attribute for tables to insert default values on failed lookup.
    • Extends as keyword to support casting between set and vector values of the same element type.

    +9 more show less

    • New packet analyzer handles PCAP files with DLT_PPP link type.
    • Adds ModBus support for Encapsulation Interface Transport (function 28) and Diagnostics (function 8) via new events.
    • ModBus file record read/write events now provide full request/response data in event data.
    • Adds full PDU length to the ModBusHeader record type.
    • Adds connection_flipped() event to update custom state when connection directionality is flipped by heuristics.
    • Allows configuring max pending HTTP requests via new HTTP::max_pending_requests option (default 100).
    • Sets offline PCAP read buffer size to 128kb, configurable via Pcap::bufsize_offline_bytes.
    • Makes SSL alerts parsing configurable with new SSL::max_alerts_per_record and caps ssl_history via SSL::max_ssl_history_length.
    • Adds optional key_func argument to from_json() to normalize JSON object key names.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The assert keyword is now reserved; using it as an identifier will break scripts.
    • !The __bro_plugin__ file generated during plugin builds is renamed to __zeek_plugin__, breaking older zkg versions that rely on the old filename.
    • !Zeek no longer traverses into dot directories in ZEEK_PLUGIN_PATH or ZEEK_SPICY_MODULE_PATH; plugins in such directories will be skipped.
    • !External plugins requiring a CMake version below 3.15 will fail to configure.
26. v6.0.1 Sep 12, 2023 · release notes

    Zeek v6.0.1 adds default_limit_includes_missing, SMB::max_dce_rpc_analyzers, connection_flipped() event, and auto community IDcommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources. logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.1 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.0.1

    └──▷ TRY IT
    Tighten memory usage for file extraction on packets with missing bytes
    copy

    $ # Add to your local.zeek or site policy
    option default_limit_includes_missing = T;

    Limit DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. analyzer proliferation in high-SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. environments
    copy

    $ # Add to your local.zeek or site policy
    const SMB::max_dce_rpc_analyzers = 5; &redef;

    Capture custom state changes when Zeek flips a connection's direction
    copy

    $ event connection_flipped(c: connection) {
      # Update custom state here
    }

    • Adds default_limit_includes_missing option to customize file size limit behavior when encountering large amounts of missed bytes
    • Adds SMB::max_dce_rpc_analyzers script variable to control the number of DCE-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. analyzers per SMB connection
    • Adds connection_flipped() event to allow updating custom state when a connection's directionality is flipped
    • Auto-logs community ID when loading policy/frameworks/notice/community-id.zeek

    4 details in Everything

27. v5.0.10 Sep 12, 2023 · release notes

    Zeek v5.0.10 adds default_limit_includes_missing option for file extraction limits and fixes DoS vectors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.10 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.0.10

28. v6.0.0 May 31, 2023 · release notes

    Zeek v6.0 adds native JavaScript support, built-in Spicy analyzers, Community IDCommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources. bif, new event timestamp APIs, and multi-logger logging paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v6.0.0

    └──▷ TRY IT
    Execute a Zeek script written in JavaScript to initialize analysis logic on startup.
    copy

    $ zeek ./hello.js

    Retrieve the network timestamp associated with the current event handler for time-correlated analysis.
    text copy

    local t = current_event_time(); print t;

    Parse a JSON string directly into a typed Zeek record to process external data sources.
    text copy

    type A: record { a: addr; }; local p = from_json('{"a": "192.168.0.1"}', A); if ( p$valid ) print (p$v as A);

    Enable the new Community ID support by loading the provided policy script alongside your standard analysis profile.
    copy

    $ @load protocols/conn/community-id-logging

    Suppress deprecation warnings in a script that relies on base scripts for compatibility while using deprecated fields.
    text copy

    @pragma push ignore-deprecations
    @load standard/init.zeek
    @pragma pop

    • Adds experimental JavaScript support via the zeekJS builtin plugin, enabling execution of .js and .cjs files with events like zeek_init.
    • Integrates Spicy analyzers directly into the Zeek code base (replacing the external plugin), allowing out-of-the-box use of Spicy-based analyzers such as Syslog and Finger.
    • Adds network timestamps to Zeek events, exposed via the new bif current_event_time() for retrieving the network time associated with a handler's execution context.
    • Introduces the from_json() bif to parse JSON strings into Zeek records with implicit type conversion.
    • Adds native Community ID support with the community_id_v1() bif and extends logs via new policy scripts protocols/conn/community-id-logging and frameworks/notice/community-id.

    +11 more show less

    • Extends ZeekControl's log archival logic to distinguish between multiple logger nodes by appending the logger's name to rotated file names, preventing data loss in multi-logger setups.
    • Adds the -V / --build-info command-line option to output verbose JSON about repository state and included plugins.
    • Exposes X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. signature types in the certificate parser via a new field in the signed portion of the certificate.
    • Enhances SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. parsing with the ssl_certificate_request event, parse_distinguished_name() function, and policy script protocols/ssl/certificate-request-info.
    • Adds networking metrics (zeek-net-dropped-packets, etc.) via the telemetry framework when the misc/stats script is loaded.
    • Parses DNS AD (authentic data) and CD (checking disabled) flags from RFC 2535, making them available in the dns_msg record.
    • Enables the supervisor framework to start worker nodes that read from a trace file.
    • Adds allow_network_time_forward=F setting to prevent automatic updates of network_time() to current time.
    • Allows configuring PcapPcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. idle timeout via the Pcap::non_fd_timeout setting (default 20usec).
    • Supports suppressing deprecation warnings in Zeek scripts using the new @pragma directive (@pragma push ignore-deprecations / @pragma pop).
    • Adds pkts_filtered field to the network statistics record type for reporting packets filtered by the interface before hand-off.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zeek treats private address space as local by default via Site::private_address_space_is_local; prior behavior can be restored with a redef to false.
    • !Telemetry centralization and Prometheus exposition is disabled by default; must be manually re-enabled by loading frameworks/telemetry/prometheus.
    • !Custom source tarballs now require a repo-info.json file at the top level for building.
    • !Plugin authors must raise the minimum required CMake version to 3.15 for compatibility with new scaffolding.
    • !Zeek container images are no longer pushed to the zeekurity organization; use zeek/zeek on DockerHub or public.ecr.aws/zeek/zeek instead.
    • !The IRC_Data analyzer declaration is now located in protocols/irc/IRC.h.
    • !Error messages for using bro_init, bro_done, and bro_script_loaded events are removed.
29. v5.2.1 Apr 11, 2023 · release notes

    Zeek v5.2.1 adds Pcap::non_fd_timeout and shifts default data stores from Broker to local.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.2.1 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.2.1

    └──▷ USE IT
    Reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage on low-traffic networks by tuning the sleep interval for Myricom or similar non-fd packet sources.
    zeek copy

    @load frameworks/pcap/pcap.zeek
    
    global Pcap::non_fd_timeout = 50us;

    • Adds Pcap::non_fd_timeout script-level option to control sleep time for non-fd packet sources
    • Changes default data store for known-{hosts,certs,services} policies from Broker to local

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Known policy data stores now default to local instead of Broker, potentially affecting cluster synchronization behavior.
30. v5.0.8 Apr 11, 2023 · release notes

    Adds Pcap::non_fd_timeout script option for tuning I/O sleep on non-fd packet sources

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.8 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.0.8

    • A new script-level option Pcap::non_fd_timeout allows fine-tuning the amount of time to sleep on each IO loop when using a packet source that doesn't provide a file descriptor (e.g. Myricom). The option defaults to 20 microseconds.
    • New wierds ayiya_empty_packet, geneve_empty_packet, and vxlan_empty_packet are added to report when packets containing these protocols do not have any further data after the tunnel header.

    2 details in Everything

31. v5.2.0 Feb 3, 2023 · release notes

    Zeek v5.2.0 adds Windows support, runtime analyzer enable/disable, event groups, and AF_PACKET builtin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.2.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.2.0

    └──▷ USE IT
    Enable a packet analyzer at runtime for targeted investigation without restarting Zeek.
    zeek copy

    Analyzer::enable_analyzer(chan, Analyzer::ANALYZER_SSL);

    Disable all event handlers in the FTP module to reduce overhead during high-volume logging periods.
    zeek copy

    disable_module_events('FTP');

    Configure SQLite durability/performance trade-offs for Broker data stores via redef.
    zeek copy

    redef Broker::SQLite::synchronous = 'normal';
    redef Broker::SQLite::journal_mode = 'wal';

    Use the new ordered attribute to preserve insertion order when iterating over a set of IPs.
    zeek copy

    local ips: set[addr] &ordered = { 10.0.0.1, 10.0.0.2 };

    • Adds experimental zeek binary for Microsoft Windows environments
    • Publishes container images to zeek/zeek and zeek/zeek-dev on Docker Hub
    • Adds af_packet as a default built-in packet source plugin on Linux
    • Adds zeekctl support for lb_method=af_packet
    • Introduces Analyzer::enable_analyzer() and Analyzer::disable_analyzer() BIFs

    +24 more show less

    • Re-introduces event groups via the &group attribute on handlers
    • Adds disable_event_group(), enable_event_group(), disable_module_events() and enable_module_events() BIFs
    • Extends Logging::Stream record with an event_groups field
    • Adds AnalyzerConfirmationInfo and AnalyzerViolationInfo record types
    • Adds analyzer_confirmation_info and analyzer_violation_info events
    • Adds helper BIFs is_protocol_analyzer(), is_packet_analyzer() and is_file_analyzer()
    • Adds AnalyzerViolation() method to file analyzers
    • Adds Analyzer::requested_analyzers set for analyzer control at init time
    • Creates new analyzer.log for logging analyzer violations and confirmations
    • Allows SQLite synchronous and journal_mode PRAGMAs configuration via Broker data stores
    • Adds integrity_check and failure_mode options for SQLite-backed Broker data stores
    • Adds join_string_set() BIF
    • Adds &ordered attribute for tables and sets
    • Adds -D argument to configure script for CMake parameters
    • Extends SSH analyzer with new events: ssh2_ecc_init, ssh2_gh_gex_init, ssh2_gss_init, ssh2_rsa_secret
    • Extends NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. analyzer to parse challenge and response fields
    • Adds FTP::max_command_length script-level variable (default 100) and FTP_max_command_length_exceeded weird
    • MySQL analyzer detects SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. encrypted sessions, adding ssl to service field in conn.log
    • Allows blank identifier _ to ignore loop variables of different types without type clash errors
    • Supports trailing commas in table, vector, set, record construction, and function calls
    • Adds get_identifier_declaring_script() and get_record_field_declaring_script() BIFs
    • Updates DNS query type strings to standardized list (30: NXT, 31: EID, 32: NIMLOC)
    • Zeek exits at startup if an external plugin shares a name with a built-in plugin
    • Removes --with-caf option from configure script

    29 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Network ports assigned to workers now start at port 27760, requiring firewall/routing updates for clusters not on FreeBSD
    • !AF_PACKET plugin options (af_packet_*) are now integrated into zeekctl; users must upgrade zeekctl bundled with Zeek 5.2
    • !The blank identifier _ can no longer be used in expressions and options, only to ignore loop variables
    • !The mysql_ok event is no longer raised; users must switch to the new mysql_eof event
    • !Zeek exits at startup if an external plugin has the same name as a built-in plugin
    • !DNS query type string representations changed for types 30 (EID to NXT), 31 (NIMLOC to EID), and 32 (NB to NIMLOC)
    • !The --with-caf configure option was removed; Broker now requires specific CAF versions
32. v5.0.6 Feb 1, 2023 · release notes

    Zeek v5.0.6 adds file_over_new_connection event and improves SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./HTTP/DNS error handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.6 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.0.6

    • Adds the file_over_new_connection event to the Intel framework for files received over established connections like HTTP.
    • Introduces a new smb_tree_connect_andx_response_without_tree weird event for SMB1 packets missing an associated request.

    2 details in Everything

33. v5.1.2 Feb 1, 2023 · release notes

    Zeek v5.1.2 adds file_over_new_connection event and new SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. warning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.1.2 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.1.2

    • Adds file_over_new_connection event to the Intel framework for handling files received over established connections like HTTP
    • Introduces a new weird event smb_tree_connect_andx_response_without_tree when receiving SMB1 packets with connect_andx_response without an associated request

    2 details in Everything

34. v5.1.0 Sep 20, 2022 · release notes

    Zeek v5.1.0 adds telemetry framework, vector iteration, and new BIFs for scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.1.0

    └──▷ USE IT
    Enable metric logging to capture telemetry data for external monitoring systems.
    text copy

    @load policy/frameworks/telemetry/log

    Veto analyzer disabling attempts for specific connections based on custom logic.
    text copy

    hook disabling_analyzer(c: connection) {
      if (c$id$resp_p == 443) break;
    }

    Use the new vector iteration syntax to process connection arrays efficiently.
    text copy

    local vec = vector(1, 2, 3);
    for ( idx, value in vec )
      print sprintf('Index: %d, Value: %d', idx, value);

    • Adds telemetry.log and telemetry_histogram.log streams for metric collection via the new base/frameworks/telemetry framework
    • Adds disabling_analyzer() hook to allow vetoing analyzer disabling decisions in scripts
    • Adds support for iterating over vector indices and values with for ( idx, value in vec ) syntax
    • Adds &log attribute redefinition on record fields, enabling patterns like redef Notice::Info$email_dest -= { &log };
    • Adds max_changes_per_connection option to limit tunnel_changed events and prevent log spam (default 5)

    +4 more show less

    • Adds new BIFs: table_keys(), table_values(), bytestring_to_float(), pow(), and bit-shift operators << and >>
    • Adds Modbus log fields for PDU type, transaction ID, and unit ID
    • Adds support for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. option 27 parsing
    • Adds new packet-analyzer for DLT_LINUX_SLL2 PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. link type

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Packet::{l2,l3}_checksummed variables replaced by Packet::l4_checksummed
    • !Dictionary and PDict classes converted to C++ templates, requiring plugin build updates
    • !files.log no longer includes tx_hosts, rx_hosts, or conn_uids fields by default; use uid and id instead
    • !files.log entries are now unrolled consistently across connections
    • !Barnyard2 policy scripts removed without deprecation
    • !Unified2 analyzer and accompanying scripts removed without deprecation
    • !packet_analysis::IP::ParsePacket return value changed to enum values, potentially breaking package builds
    • !Conditional directives (@if, etc.) cannot follow if, for, or while statements directly; braces are now required
    • !bro symlink to zeek binary removed
    • !is_orig field in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS events renamed to is_client
35. v5.0.0 Jun 3, 2022 · release notes

    Zeek v5.0 adds a single-instance cluster management framework with zeek-client, TLS decryption, event tracing, and script profiling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v5.0.0

    └──▷ USE IT
    Profile script execution to identify performance bottlenecks in CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. time or memory usage upon termination.
    shell copy

    zeek --profile-scripts=profile.tsv script.zeek

    Enable WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. communication for external clients to exchange events with Zeek via JSON on port 9997.
    zeek copy

    Broker::listen_websocket()

    Configure the build to use a specific directory for persistent state rather than the default var/lib.
    shell copy

    ./configure --statedir=/custom/state/dir

    • Adds zeek-client executable as the cluster management client for uploading configs, deploying them, checking node status, restarting nodes, and retrieving global identifiers.
    • Loads the cluster controller via policy/frameworks/management/controller and agents via policy/frameworks/management/agent to enable single-instance cluster setups on one machine.
    • Adds --no-unused-warnings CLI option to suppress warnings for unused functions, hooks, and event handlers; use &is_used attribute in scripts to suppress specific instances.
    • Adds --profile-scripts[=file] command-line option (default: stdout) that writes a TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. profile of every function body including call counts, CPU time, and memory allocated upon termination.
    • Adds --event-trace / -E command-line options to generate and replay event traces.

    +6 more show less

    • Adds experimental limited TLS decryption capabilities requiring the pre-master secret and supporting only TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on TLS 1.2 connections.
    • Enables WebSocket support for external clients by calling Broker::listen_websocket(), which starts listening on port 9997 for JSON messages.
    • Adds new BiFs val_footprint() and global_container_footprints() as substitutes for the deprecated val_size() and global_sizes() to estimate memory consumption.
    • Adds Supervisor::node_status and SupervisorControl::node_status events to notify recipients when a stem process (re-)starts a node, indicating the node name and new PID.
    • Adds --statedir configure option to adjust the installation's persistent state directory, defaulting to var/lib under the Zeek installation root.
    • Provides base/misc/installation.zeek script to expose key directories of the Zeek installation.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zeek now requires at least CMake version 3.15.0.
    • !If configured with included Spicy (default), Zeek now requires Flex >= 2.6, Bison >= 3.3, and GCC >= 8.3 or Clang >= 9.0.
    • !The script-land union and timer types have been removed without deprecation.
    • !Broker uses a new network backend incompatible with the pre-5.0 backend; Zeek 4.x will not be able to exchange events with Zeek 5.x.
36. v4.2.0 Jan 5, 2022 · release notes

    Zeek v4.2.0 adds ZAM script optimization, unprocessed packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate./SVCB DNS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v4.2.0

    └──▷ TRY IT
    Capture and dump packets that were not processed by any analyzer for debugging.
    copy

    $ zeek -c capture.pcap --capture-unprocessed example.zeek

    Configure JSON logging to include unset optional fields as null for consistent data import.
    zeek copy

    redef LogAscii::json_include_unset_fields = T;

    • Experimental ZAM script execution compiler activated via -O ZAM.
    • New --optimize-files and --optimize-funcs flags to restrict ZAM or C++ compilation optimization to specific scripts or functions.
    • Packet analyzer framework gains protocol detection via PacketAnalyzer::register_protocol_detection in scripts and PacketAnalyzer::DetectProtocol in C++.
    • New Plugin::HookUnprocessedPacket plugin hook and packet_not_processed event for packets that bypass analysis.
    • CLI flag -c / --capture-unprocessed to dump packets that were not processed by any analyzer.

    +5 more show less

    • DNS analyzer supports SVCB and HTTPS types, generating dns_SVCB and dns_HTTPS events.
    • find_str and rfind_str bifs now accept case-insensitive search arguments.
    • JSON logger respects LogAscii::json_include_unset_fields to include unset &optional fields as null in logs.
    • Official Docker images available via zeekurity/zeek (release tags) and zeekurity/zeek-dev (latest master merge).
    • New cmake function zeek_plugin_scripts() for Zeek plugin build dependency tracking.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing C++ types like zeek::Analyzer::Tag are merged into a single type zeek::Tag; plugins relying on distinct Tag types for overloading will fail to build and must replace all zeek::*::Tag usage with zeek::Tag.
    • !The -uu flag for analyzing unused record fields has been removed.
37. v4.0.3 Aug 15, 2021 · release notes

    Zeek v4.0.3 updates input framework handling of unset fields and makes ssh.log version optional

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.3 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v4.0.3

    • Input framework now skips lines with unset fields for non-optional record fields or complex table indexes, enforcing &optional requirement
    • ssh.log version field is now optional, suppressing output when client/server versions cannot be determined

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Input framework logic change: lines containing unset fields for non-optional record fields or complex table indexes are now silently skipped rather than potentially causing inconsistent state
    • !ssh.log schema change: the version field is no longer guaranteed to be present; scripts must handle the case where it is unset/missing
38. v4.1.0 Aug 10, 2021 · release notes

    Zeek v4.1.0 adds Telemetry API, VN-Tag analyzer, script RD analysis, and more generic session management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    └──▷ TRY IT
    Run Zeek script analysis to find unused variables and unset record fields.
    copy

    $ zeek -u script.zeek

    • Adds zeek -u and zeek -uu options for Reaching Definitions analysis to detect unused local variables and unset record fields.
    • Adds LogAscii::logdir option to the ASCII writer to change the logging output directory.
    • Adds global policy hook Log::log_stream_policy for pre-write log stream processing and vetoing.
    • Adds NodeConfig.env and NodeConfig.bare_mode members for controlling Supervisor-launched node environment and bare-mode state.
    • Adds x509_check_hostname and x509_check_cert_hostname BIFs, and sni_matches_cert field to ssl.log, for hostname validation.

    +8 more show less

    • Adds new functions enable_analyzer(), disable_analyzer(), and analyzer_enabled() to dynamically manage file analyzers at runtime.
    • Adds Telemetry API for gathering runtime metrics and exporting to Prometheus.
    • Adds support for VN-Tag packet analyzer headers to skip past them for further analysis.
    • Adds Geneve packet decapsulation support similar to existing VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. support.
    • Adds --include-plugins argument to configure for statically built plugin paths.
    • Adds --plugindir argument to configure to set the plugin installation path.
    • Adds initial cluster controller framework and zeek-client management client with --enable-zeek-client configure option.
    • Renames NetSessions class to SessionMgr for more generic session management.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for the RocksDB Broker data store is removed; all related code and options are gone.
    • !The default logging behavior for X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificates has changed: they are no longer logged into files.log by default (configurable via X509::log_x509_in_files_log).
    • !The ssl.log file no longer includes certificate issuer and subject information by default (configurable via SSL::log_include_server_certificate_subject_issuer and SSL::log_include_client_certificate_subject_issuer).
    • !The input framework now skips input lines with unset fields for non-optional record fields, whereas previously it may have accepted them.
39. v4.0.0 Dec 15, 2020 · release notes

    Zeek v4.0 adds zkg package manager, new packet analysis plugin architecture, EDNS0 support, and extensive BIFs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    └──▷ TRY IT
    Override the default zkg configuration path using an environment variable for a custom package repository setup.
    copy

    $ export ZKG_CONFIG_FILE=/etc/custom-zkg/config && zkg install zeek/zeek-aux

    Enable logging for protocols not natively supported by Zeek using the new packet analysis framework.
    copy

    $ cat <<EOF > load-unknowns.zeek
    @load policy/misc/unknown-protocols
    EOF
    zeek load-unknowns.zeek your_capture.pcap

    • zeek now bundles the zkg package manager with its toplevel script at $prefix/bin/zkg, config at $prefix/etc/zkg/config, and state at $prefix/var/lib/zkg. Use the ZKG_CONFIG_FILE environment variable or the --configfile CLI flag to override the default configuration path.
    • New Packet Analysis plugin architecture allows writing plugins to parse packet headers below Session analysis, enabling chained parsing of individual packet parts.
    • dns_LOC, dns_SSHFP, and dns_NSEC3PARAM events now trigger for their respective resource records, expanding DNS coverage beyond standard A/AAAA/MX/etc. records.
    • CaptureLoss::initial_watch_interval option provides immediate capture loss feedback upon cluster restart without waiting for the full default 15-minute interval.
    • zeek_script_args variable exposes command-line arguments passed to a script, supporting both explicit execution (zeek -- myscript.zeek -arg1) and hashbang-style interpretation.

    +12 more show less

    • generate_all_events bif forces event generation even when unused by scripts, enabling comprehensive logging via dump-events.zeek.
    • New unknown_protocols.log logs unsupported analyzer/protocol pairs via the packet analysis framework; enable it by loading the policy/misc/unknown-protocols script.
    • Weird::sampling_global_list option configures global rate-limiting for certain weirds across all connections/flows instead of per-connection limiting.
    • PcapPcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.::findalldevs() returns available network devices, enabling programmatic selection of capture interfaces.
    • Support for SSH version 1.99 allows detection of clients/servers advertising this special version indicating support for both SSH2 and SSH1.
    • udp-state signature condition enforces matching against the originator or responder flow direction of UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packets.
    • New BIFs count_substr, find_str, rfind_str, starts_with, ends_with, is_num, is_alpha, is_alnum, ljust, rjust, swap_case, to_title, zfill, remove_prefix, and remove_suffix provide comprehensive string processing capabilities.
    • New BIFs count_to_double() and int_to_double() enable explicit type conversion from integer types to double.
    • enum_names() BIF returns the names of an enum type's values for introspection.
    • type_aliases BIF allows introspecting type-names of types/values.
    • Composite-index support for &backend (Broker-backed tables) enables complex indexing, e.g., set[string, count, count].
    • Sumstats now supports manual epochs; specifying an epoch interval of 0 requires manual ending via SumStats::next_epoch, allowing synchronization with other events.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !NetControl::DROP_LOG replaces the previous NetControl::DROP enum use as type Log::ID.
    • !NetControl::DROP_REQUESTED replaces the previous NetControl::DROP enum use as type NetControl::CatchReleaseInfo.
    • !Python 2 is no longer supported; Python 3.5 is the new minimum requirement.
    • !CMake versions less than 3.5 are no longer supported.
    • !CAF version 0.18 is now required and bundled by default unless overridden with --with-caf=.
40. v3.2.0 Jul 27, 2020 · release notes

    Zeek v3.2.0 adds X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate caching, RDPEUDP parsing, udp_content_ports config, Broker table sync via &backend attr, and ISO9660/Python bytecode file signatures

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    └──▷ USE IT
    Sync a global counter table across a Zeek cluster using Broker MEMORY backend for high availability.
    config copy

    global t: table[string] of count &backend=Broker::MEMORY;

    Opt-in to RocksDB persistent storage for Broker data stores during Zeek configuration.
    shell copy

    ./configure --enable-rocksdb --with-rocksdb=/usr/local/rocksdb

    • Adds udp_content_ports configuration option to control which UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ports raise the udp_contents event.
    • Adds X509 certificate caching (enabled by default) to reduce parsing overhead for frequently seen certificates.
    • Adds parsing support for Remote Desktop Protocol UDP Transport Extension (RDPEUDP versions 1 and 2).
    • Adds a file signature to identify ISO9660 disk images (application/x-iso9660-image).
    • Adds a file signature to identify Python bytecode (application/x-python-bytecode).

    +4 more show less

    • Allows events and hooks to have multiple, alternate prototype declarations for safer extension.
    • Adds flags parameters to rdp_connect_request, rdp_negotiation_response, and rdp_negotiation_failure events.
    • Adds experimental Broker Store table synchronization using the new &backend attribute on tables/sets.
    • Raises the new expired_conn_weird event in Reporter::conn_weird for expired connections without state info.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !RocksDB support is now opt-in; use the --enable-rocksdb and --with-rocksdb= flags to enable it.
    • !BIF arguments are passed as a std::vector<IntrusivePtr<Val>> rather than val_list, which may break custom BIF implementations.
    • !The connection_external event has been removed; handlers for this event will no longer trigger.
    • !Reorganized file signatures may break scripts that explicitly load moved signature files.
    • !Multiple C++ classes were moved from the global namespace into zeek or zeek::detail, requiring updates to external plugins that referenced them directly.
41. v3.1.0 Feb 25, 2020 · release notes

    Zeek v3.1.0 adds Supervisor mode (-j), speculative protocol detection via dpd_late_match_stop, tcp_options event, &on_change attribute, and Log::print_to_log.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    └──▷ TRY IT
    Launch Zeek in Supervisor mode to manage a cluster of persistent processing nodes.
    copy

    $ zeek -j <path_to_supervisor_script>

    Set up a hook to watch for changes in a tracking table.
    📍global my_table: table[string] of string &on_change = on_table_changed;
    • Adds -j CLI flag to enable the experimental Supervisor deployment mode for clustering Zeek processes without external tools
    • Adds dpd_late_match_stop configuration option, protocol_late_match event, and speculative_service.zeek policy script for late protocol matching in conn.log
    • Adds new tcp_options event raised for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. headers containing options
    • Adds Log::print_to_log scripting function to redirect print output to log streams instead of stdout
    • Adds &on_change attribute for tables and sets to notify of modifications

    +1 more show less

    • Adds successful_connection_remove event and connection_successful event, plus successful record field in the connection record

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zeek no longer accepts multiple -r or -i flags; only a single packet source is allowed from the command-line
    • !The IOSource API methods GetFds() and NextTimestamp have been removed; custom IOSource implementations must update their code
    • !Scripts with .bro endings now abort with an error instead of a warning; rename to .zeek or remove backwards-compatibility wrappers
    • !Broker wireformat changes prevent connecting to Broker/Zeek versions prior to 3.1; all instances must upgrade simultaneously
42. v3.0.0 Sep 23, 2019 · release notes

    Zeek v3.0 adds MQTT analysis, VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. decapsulation, duration thresholding, and DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit./NTP/TLS1.3 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • ZEEK_DNS_RESOLVER environment variable to specify a custom DNS resolver.
    • @load policy/protocols/mqtt to enable MQTT v3.1/v3.1.1 protocol analysis and logging.
    • SMB2::NegotiateResponse fields negotiate_context_count and negotiate_context_values for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. 3.x capability info.
    • Intel::filter_item hook to filter intelligence items before insertion.
    • InputAscii::path_prefix, InputBinary::path_prefix, and Intel::path_prefix config keys to control source paths.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !bro, bro-config, broctl, and bro-cut executables emit deprecation warnings; use zeek, zeek-config, zeekctl, and zeek-cut instead.
    • !local.bro site script is renamed to local.zeek; .bro scripts in the tree are renamed to .zeek.
    • !dns_state record fields pending_queries and pending_replies are now optional; use new pending_query field.
43. v2.6 Jul 8, 2019 · release notes

    Zeek v2.6 introduces Broker framework, dynamic options, OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./SCT support, MOUNT3 parser, and script language extensions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6 https://github.com/zeek/zeek.git
    # already have the repo? check out this version:
    $ git checkout v2.6

    └──▷ USE IT
    Dynamically update a script option from an external file at runtime without restarting
    text copy

    redef Config::config_files += { "/etc/zeek/options.dat" };

    Subscribe to runtime changes of an option variable and process the new value when it updates
    text copy

    event bro_init() { Option::set_change_handler("my_opt", my_handler); } function my_handler(id: string, val: bool): bool { print fmt("%s changed to %s", id, val); return val; }

    • Introduces the broker framework (base/framework/broker) as the new communication layer, replacing the deprecated communication framework
    • Adds option keyword and Config::set_value / Option::set_change_handler functions for runtime dynamic configuration updates across a cluster
    • Enables reading option changes from external files via Config::config_files with format [option name][tab/spaces][new variable value]
    • Adds OCSP and Signed Certificate Timestamp support with events like ocsp_request, x509_ocsp_ext_signed_certificate_timestamp and BIFs sct_verify, x509_subject_name_hash
    • Adds new TLS parser events: ssl_ecdh_server_params, ssl_dh_server_params, ssl_server_signature, ssl_ecdh_client_params, ssl_dh_client_params, ssl_rsa_client_pms

    +8 more show less

    • Adds ssl_finishing(c: connection) hook in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. scripts to trigger actions after the handshake concludes
    • Introduces HTTP events for upgraded connections including http_connection_upgrade and whitelist policy hook HTTP::sqli_policy
    • Adds MOUNT3 protocol parser with events mount_proc_null, mount_proc_mnt, etc. (requires manual port/DPD registration)
    • Adds new SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. events: smb1_transaction_secondary_request, smb1_transaction2_secondary_request, smb1_transaction_response and moves SMB scripts to base/protocols/smb
    • Enables KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket decryption from a keytab file using the standard Bro script framework
    • Adds is and as script operators for dynamic type-checking and casting, plus case type T syntax in switch statements
    • Adds bitwise operators &, |, ^ (binary) and ~ (unary) on count values, and case-insensitive pattern matching with suffix /pattern/i
    • Adds functions Files::file_exists, Files::lookup_File, Log::get_filter_names, and Log::enable_stream to existing APIs

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !communication framework is deprecated and superseded by broker; scripts using the old framework must be migrated
    • !ssl_server_curve event is deprecated in favor of ssl_ecdh_server_params
    • !ssl_application_data event is retired and replaced by ssl_plaintext_data
    • !Event signatures for ssl_client_hello, ssl_server_hello, and ssl_encrypted_data have changed to include new fields