Zeek — The Cyber Toolchain

Zeek v9.0.0

Fri, 21 Aug 2026 20:24:47 GMT

Zeek 9.0 adds UDP packet source for VXLAN/GENEVE mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAP SASL forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `zeek -i udp::0.0.0.0:4789:vxlan` UDP packet source (bundled `zeek-packet-source-udp` plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses `SO_REUSEPORT` for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds VNI-aware connection tracking via `policy/frameworks/conn_key/packet_source/udp/vxlan_vni` policy script when using the UDP packet source. • Adds `policy/files/zip/register.zeek` to map the bundled Spicy ZIP file analyzer to the `application/zip` MIME type; recursive ZIP depth is controlled by `Spicy::max_file_depth`. • Adds `policy/protocols/conn/multicast-participants.zeek` producing a new `multicast_participants.log` with IGMP-derived data about hosts participating in multicast connections. • Adds two new NTP logs — `ntp_control.log` and `ntp_private.log` — covering NTP modes 6 and 7, which were previously unlogged. • Adds `Log::json_string_escape_policy` (type `JSON::STRING_ESCAPE_POLICY_*`) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains `JSON::STRING_ESCAPE_POLICY_HEX`. • Extends `zeek.conf` and `zeek-systemd-generator` to support multiple interfaces and multi-host deployments. • Adds `ssl_extension_encrypted_client_hello` event carrying information about the TLS `encrypted_client_hello` extension. • Adds `ssl_extension_signature_algorithms_cert` event raised for the TLS `signature_algorithms_cert` extension. • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPC PDUs. • Extends the LDAP analyzer to forward SASL payloads from `bindRequest`/`bindResponse` to GSSAPI and NTLM parsers, enriching `ntlm.log` and `kerberos.log`. • Extends the Syslog analyzer to support TCP via Octet Counting and Non-Transparent-Framing on port 514/tcp. • Adds DPD signatures for QUIC version 1 and QUIC version 2 to attach the QUIC analyzer on non-port-443 UDP connections on signature match. • Adds `?as` operator to test whether a value can be safely cast to a target type at script level. • Adds `Reporter::limit_reached_weird` BIF to report size-limit violations, logging a named weird and appending `X` to the connection `history` field. • Adds `$attributes` field to `script_id` records returned by global_ids() BiF, exposing identifier attributes. • Extends krb_ap_request() event with an `in_kdc_padata` parameter to indicate whether the AP-REQ is embedded in KDC/TGS pre-authentication data. • Extends `kerberos.log` AP entries to populate the `service` and `cipher` columns, which were previously unset. • Extends the `known-certs`, `known-hosts`, and `known-services` scripts with storage-framework options including `enable_hosts_persistence`, `host_store_prefix`, `host_store_backend_type`, and `host_store_backend_options` (SQLite backend under `Cluster::default_store_dir` by default). • Extends the HTTP analyzer with nine new weirds — `HTTP_bad_chunk_size`, `HTTP_chunked_multi`, `HTTP_content_length_0_and_expect_100_cont`, `HTTP_content_length_leading_zeros`, `HTTP_bad_content_length`, `HTTP_obsolete_line_folding`, `HTTP_content_length_and_chunked`, `HTTP_content_range_and_chunked`, and `HTTP_expect_not_100_continue` — for unusual Content-Length, Transfer-Encoding, and Expect header usage. • Extends the Input Framework to read pattern values with case-insensitive (`/foo/i`) and single-line (`/bar/s`) modifiers. • Extends the `as` casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions. • Makes `OpaqueType` non-final and adds hooks for hashing, casting, and default initialization, enabling plugins to introduce new scripting types storable in sets/tables and castable to existing Zeek types (experimental). • Splits `zeromq/main.zeek` options into a separate `zeromq/options.zeek` file to allow standalone Zeek processes to connect to the ZeroMQ layer without participating in cluster node events. Breaking changes: • Broker's legacy embedded WebSocket server is fully removed: `Broker::BrokerProtocol`, `Broker::default_port_websocket`, `Broker::default_listen_address_websocket`, `Broker::web_socket_buffer_size`, and `Broker::web_socket_overflow_policy` no longer exist. Use Cluster::listen_websocket() and the `ZEEK_WEBSOCKET_*` environment variables instead. • The `BrokerProtocol` enum has been removed and the Broker manager's Listen() C++ method no longer accepts its optional `BrokerProtocol` argument; it always uses Broker's native protocol. • Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format(). • The ZeekJS plugin now requires `std::format` from C++20, dropping support for older distributions using GCC 12.x such as Debian 12. • FreeBSD is no longer officially supported with CI testing; it moves to the same community-patch model as OpenBSD. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v9.0.0

Fri, 21 Aug 2026 20:24:47 GMT

Zeek 9.0 adds UDP packet source for VXLAN/GENEVE mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAP SASL forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `zeek -i udp::0.0.0.0:4789:vxlan` UDP packet source (bundled `zeek-packet-source-udp` plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses `SO_REUSEPORT` for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds VNI-aware connection tracking via `policy/frameworks/conn_key/packet_source/udp/vxlan_vni` policy script when using the UDP packet source. • Adds `policy/files/zip/register.zeek` to map the bundled Spicy ZIP file analyzer to the `application/zip` MIME type; recursive ZIP depth is controlled by `Spicy::max_file_depth`. • Adds `policy/protocols/conn/multicast-participants.zeek` producing a new `multicast_participants.log` with IGMP-derived data about hosts participating in multicast connections. • Adds two new NTP logs — `ntp_control.log` and `ntp_private.log` — covering NTP modes 6 and 7, which were previously unlogged. • Adds `Log::json_string_escape_policy` (type `JSON::STRING_ESCAPE_POLICY_*`) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains `JSON::STRING_ESCAPE_POLICY_HEX`. • Extends `zeek.conf` and `zeek-systemd-generator` to support multiple interfaces and multi-host deployments. • Adds `ssl_extension_encrypted_client_hello` event carrying information about the TLS `encrypted_client_hello` extension. • Adds `ssl_extension_signature_algorithms_cert` event raised for the TLS `signature_algorithms_cert` extension. • Adds dce_rpc_auth() event for script-level access to the security provider, per-message protection, and authentication context in DCE-RPC PDUs. • Extends the LDAP analyzer to forward SASL payloads from `bindRequest`/`bindResponse` to GSSAPI and NTLM parsers, enriching `ntlm.log` and `kerberos.log`. • Extends the Syslog analyzer to support TCP via Octet Counting and Non-Transparent-Framing on port 514/tcp. • Adds DPD signatures for QUIC version 1 and QUIC version 2 to attach the QUIC analyzer on non-port-443 UDP connections on signature match. • Adds `?as` operator to test whether a value can be safely cast to a target type at script level. • Adds `Reporter::limit_reached_weird` BIF to report size-limit violations, logging a named weird and appending `X` to the connection `history` field. • Adds `$attributes` field to `script_id` records returned by global_ids() BiF, exposing identifier attributes. • Extends krb_ap_request() event with an `in_kdc_padata` parameter to indicate whether the AP-REQ is embedded in KDC/TGS pre-authentication data. • Extends `kerberos.log` AP entries to populate the `service` and `cipher` columns, which were previously unset. • Extends the `known-certs`, `known-hosts`, and `known-services` scripts with storage-framework options including `enable_hosts_persistence`, `host_store_prefix`, `host_store_backend_type`, and `host_store_backend_options` (SQLite backend under `Cluster::default_store_dir` by default). • Extends the HTTP analyzer with nine new weirds — `HTTP_bad_chunk_size`, `HTTP_chunked_multi`, `HTTP_content_length_0_and_expect_100_cont`, `HTTP_content_length_leading_zeros`, `HTTP_bad_content_length`, `HTTP_obsolete_line_folding`, `HTTP_content_length_and_chunked`, `HTTP_content_range_and_chunked`, and `HTTP_expect_not_100_continue` — for unusual Content-Length, Transfer-Encoding, and Expect header usage. • Extends the Input Framework to read pattern values with case-insensitive (`/foo/i`) and single-line (`/bar/s`) modifiers. • Extends the `as` casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions. • Makes `OpaqueType` non-final and adds hooks for hashing, casting, and default initialization, enabling plugins to introduce new scripting types storable in sets/tables and castable to existing Zeek types (experimental). • Splits `zeromq/main.zeek` options into a separate `zeromq/options.zeek` file to allow standalone Zeek processes to connect to the ZeroMQ layer without participating in cluster node events. Breaking changes: • Broker's legacy embedded WebSocket server is fully removed: `Broker::BrokerProtocol`, `Broker::default_port_websocket`, `Broker::default_listen_address_websocket`, `Broker::web_socket_buffer_size`, and `Broker::web_socket_overflow_policy` no longer exist. Use Cluster::listen_websocket() and the `ZEEK_WEBSOCKET_*` environment variables instead. • The `BrokerProtocol` enum has been removed and the Broker manager's Listen() C++ method no longer accepts its optional `BrokerProtocol` argument; it always uses Broker's native protocol. • Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format(). • The ZeekJS plugin now requires `std::format` from C++20, dropping support for older distributions using GCC 12.x such as Debian 12. • FreeBSD is no longer officially supported with CI testing; it moves to the same community-patch model as OpenBSD. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.0.8

Tue, 12 May 2026 19:14:56 GMT

Zeek v8.0.8 adds MIME header size cap with new variable and weird to mitigate DoS via crafted SMTP/HTTP packets. • Adds `MIME::max_header_bytes` script variable to cap the maximum size of a MIME header, limiting memory exhaustion from crafted SMTP or HTTP packets. • Adds `exceeded_mime_max_header_bytes` weird reported when a MIME header exceeds the configured byte limit, halting further processing of that packet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.2.0

Tue, 12 May 2026 19:14:11 GMT

Zeek v8.2.0 adds ZeroMQ CURVE encryption, IGMP analyzer, &publish_on_change for cluster tables, and configurable analyzer ports. • New `&publish_on_change` attribute for global tables and sets enables efficient publishing of selected table changes as remote events to a configurable cluster topic, replacing deprecated Broker-specific sync attributes. • ZeroMQ cluster communication now supports CURVE encryption; keys auto-generated by ZeekControl when a multi-node cluster is detected, or manually configured via `cluster_backend_zeromq.use_curve_encryption`. • ZeroMQ XPUB/XSUB proxy metrics (`zeek_cluster_zeromq_proxy_{frontend,backend}_{bytes,messages}_{sent,received}`) are now exposed for cluster traffic monitoring. • Well-known ports for built-in analyzers are now configurable via `redef`, e.g. `redef HTTP::ports += { 8181/tcp }`. • New IGMP analyzer adds events for each IGMP message type. • The `dns.log` now records DNS notifications (RFC 1996) with `opcode` 4 and `opcode_code` "notify". • The `@load` directive now supports loading shared object (`.so`) files directly, enabling alternative plugin layouts without `ZEEK_PLUGIN_PATH` discovery. • New `connection_timing_out` hook allows scripts to prevent Zeek from timing out a specific connection, useful for keeping shunted connections alive. • New `modulo` BiF added, with different behavior from `%` for negative numbers. • The `&on_change` attribute for tables and sets now accepts variable-argument functions. • Windows support substantially improved; btest suite now runs on CI and the majority of tests pass. • X.509 parsing now supports additional key types (e.g. ML-DSA) for certificate key length and `key_type` fields. • SMTP analyzer now forwards the first gap encountered during RFC 822 message analysis to the file object, enabling gap detection via `missing_bytes` in `files.log`. Breaking changes: • The minimum version requirement for ZeroMQ is now 4.3.0; older ZeroMQ installations will no longer work. • Enums are now nominally typed; scripts mixing incompatible enum types (e.g. `color` and `city`) will produce warnings now and errors in v9.1. • The `BifEnum` namespace was moved into the `zeek` namespace; scripts or plugins referencing `BifEnum::` directly will break. • The `MetricsAddress` default in zeekctl.cfg changed from `0.0.0.0` to `127.0.0.1`; remote Prometheus scrapers or containerized deployments must now explicitly set `MetricsAddress = 0.0.0.0` in zeekctl.cfg. • btest Traces library packet captures now use `.pcap`/`.pcapng` suffixes; plugins referencing the old `.trace` suffix will break. • The public `vlan` and `inner_vlan` C++ `Packet` members changed from `uint32_t` to an optional `VlanTag` struct; the `dei` and `pcp` members were removed and merged into `VlanTag`. C++ plugins accessing these fields must be updated (access via `packet.vlan->id` after checking the optional). • ASCII control characters < 32 in JSON strings are now escaped as `\xXX` again (reverted from the `\u00XX` style introduced in Zeek 8.1); consumers relying on the `\u00XX` encoding from 8.1 will see changed output. • FreeBSD is no longer an officially-supported platform; regular CI builds on FreeBSD have been dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.1.0

Mon, 15 Dec 2025 19:17:27 GMT

Zeek v8.1.0 adds log length truncation vars, SHA-224/384/512 hashes, QUIC discarded packet events, and systemd generator. • Adds `Log::default_max_field_string_bytes` and three other log truncation variables to control maximum string and container lengths in output • Adds SHA-224, SHA384, and SHA512 hash BiFs (`sha224_hash`, `sha384_hash`, `sha512_hash` and their init/update/finish counterparts) • Adds `QUIC::discarded_packet` event for packets with fixed_bit 0, controllable via `QUIC::max_discarded_packet_events` • Adds `zeek-systemd-generator` executable and `/etc/zeek/zeek.conf` for opinionated single-node cluster deployment on Linux Breaking changes: • `ClusterBackend` in `zeekctl.cfg` now defaults to ZeroMQ; existing Broker users must set `ClusterBackend = Broker` and run `zeekctl deploy`. • Python 3.10 is now required for Zeek. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek 8.1.0

Mon, 15 Dec 2025 19:17:27 GMT

Zeek 8.1.0 adds LogAnalyzer field-length controls, new hooks, and macOS ZeekJS support. • Adds the ability to control the maximum length of strings and containers in log output fields via Log::set_field_max_length() or similar config keys. • Adds `TapAnalyzer` class allowing scripts to tap into all packets delivered to child analyzers attached to session adapters. • Adds two new hooks Cluster::on_subscribe() and Cluster::on_unsubscribe() to observe subscription events on cluster backends. Breaking changes: • The default cluster backend for standalone `zeek` invocations changed from Broker to No-op (`Cluster::CLUSTER_BACKEND_NONE`). • Zeek now requires Python 3.10 or later; older versions will fail to run. • The `&backend` and `&broker_store` script attributes now cause startup errors if used with a non-Broker cluster backend. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.0.3

Wed, 15 Oct 2025 18:04:48 GMT

Zeek v8.0.3 adds `tls_options_websocket` for TLS configuration on the management controller's WebSocket server. • Adds `tls_options_websocket` variable to the management framework controller configuration for setting TLS options on the controller's WebSocket server. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.0.1

Tue, 26 Aug 2025 18:45:38 GMT

Zeek v8.0.1 adds a new Zeekctl MetricsAddr option and moves official Docker images to Debian 13 (trixie). • Adds `MetricsAddr` option in Zeekctl to override the address the telemetry framework uses when communicating with Prometheus (defaults to `0.0.0.0`). • Official Zeek Docker images are now based on Debian 13.0 (trixie). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v8.0.0

Tue, 12 Aug 2025 19:46:42 GMT

Zeek 8.0 adds pluggable connection tracking, Redis analyzer, SMTP .eml extraction, ZeroMQ cluster support, and more. • Adds pluggable, customizable connection tracking with a built-in VLAN-aware five-tuple implementation (`frameworks/conn_key/vlan_fivetuple`). • Adds ZeroMQ cluster backend support in ZeekControl via `ClusterBackend = ZeroMQ` and `UseWebSocket = 1` in zeekctl.cfg. • Adds configurable cluster telemetry with per-event, per-topic, and histogram metrics via `Cluster::core_metrics` and `Cluster::websocket_metrics`. • Adds X-Application-Name HTTP header support on the WebSocket API (`v1/messages/json`) for per-application cluster event metrics. • Adds Redis protocol analyzer (from spicy-redis) enabled by default, logging commands and replies to `redis.log`. • Adds SMTP RFC 822 message forwarding to the file analysis framework, enabling `.eml` extraction from SMTP traffic. • Adds a generic `EventMetadata` module with current() and current_all() functions for accessing per-event metadata. • Adds new HookPublishEvent() plugin hook for intercepting, monitoring, modifying, or rerouting published cluster events. • Adds explicit TLS support (AUTH TLS) to the FTP analyzer. Breaking changes: • Zeek now requires the ZeroMQ library (`libzmq5`, `libzmq3-dev`, `cppzmq-dev`) to build and run. • Building Zeek now requires a C++20-capable compiler (GCC 10+, Clang 8+, or Visual Studio 2022+). • The `zeek::Span` class is deprecated; telemetry subsystem APIs now use `std::span` — plugins using `zeek::Span` for counter/gauge instantiation need updates. • Broad `#include` cleanup across the codebase may break third-party plugin builds. • lookup_connection() and connection_exists() now strictly require a `conn_id` instance; duck-typed `conn_id`-like records are no longer accepted. • Network timestamps are no longer added to events by default; re-enable with `redef EventMetadata::add_network_timestamp = T;`. • The ASCII writer's `JSON::TS_MILLIS` format now produces signed integers for pre-epoch timestamps; revert with `redef LogAscii::json_timestamps = JSON::TS_MILLIS_UNSIGNED;`. • The `endpoint` label in Prometheus and `telemetry.log` metrics is renamed to `node`; revert with `redef Telemetry::metrics_endpoint_label = "endpoint";`. • current_event_time(), Event::Time(), and EventMgr::CurrentEventTime() now return `-1.0` (instead of `0.0` or a stale timestamp) when no timestamp metadata is available. • Missing network timestamp metadata on remote events is no longer silently set to local network time; re-enable with `redef EventMetadata::add_missing_remote_network_timestamp = T;`. • The IsPacketSource() method on `IOSource` has been removed. • The `--with-binpac` and `--with-bifcl` `configure` arguments are deprecated and may break cross-compilation workflows. • The `ssl_session_ticket_handshake` event payload no longer includes the two extra leading bytes that preceded the session ticket data; scripts that worked around this must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.2.2

Mon, 21 Jul 2025 18:50:37 GMT

Zeek v7.2.2 adds a configurable max log record size with a new weird and metric to guard against DoS via oversized log entries. • New `Log::max_log_record_size` redefinable constant lets operators cap the size of individual log records to limit DoS exposure from oversized entries. • New `log-writer-discarded-writes` metric tracks how often log entries are dropped due to the size limit, enabling operational monitoring of the control. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.0.9

Mon, 21 Jul 2025 18:49:12 GMT

Zeek v7.0.9 adds a configurable max log record size limit with a new weird and metric to guard against DoS via oversized records. • New `Log::max_log_record_size` redefinable constant lets operators cap the size of individual log records to prevent memory overflow from crafted packets. • New `log_record_too_large` weird is raised whenever a log entry exceeds the configured size limit, enabling detection and alerting. • New `log-writer-discarded-writes` metric tracks how often log entries are dropped due to exceeding the size limit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.2.0

Fri, 25 Apr 2025 19:17:34 GMT

Zeek v7.2.0 adds a new Storage framework (SQLite/Redis), Cluster WebSocket API, Geneve tunnel extraction, and expanded Broker metrics. • Adds a new Storage framework with SQLite and Redis backends, replacing Broker-based storage; supports async (`Storage::Async`) and sync (`Storage::Sync`) modes and cluster environments. • Adds Cluster::listen_websocket() to expose WebSocket connectivity across any cluster backend, with new Cluster::websocket_client_added() and Cluster::websocket_client_lost() events. • Adds PacketAnalyzer::Geneve::get_options() builtin to extract Geneve tunnel options from the current packet in scripts. • Adds is_valid_subnet() function mirroring is_valid_ip() for subnet validation. • Adds a new `enc_part` field to `KRB_Response` (passed in `krb_as_response`), exposing the cipher and encrypted session data from Kerberos AS responses. • Adds three new Broker peer buffer metrics: `zeek_broker_peer_buffer_messages`, `zeek_broker_peer_buffer_recent_max_messages`, and `zeek_broker_peer_buffer_overflows_total` for per-peer send buffer health monitoring. • Adds `Broker::log_severity_level` and `Broker::log_stderr_severity_level` options to control propagation of Broker log messages as Zeek events into `broker.log`. • Adds `DPD::track_removed_services_in_connection` option and a new `protocols/conn/failed-service-logging.zeek` policy script that adds a `failed_service` column to `connection.log`. • Adds a warning when scripts declare DNS events that are suppressed by `dns_skip_all_addl` being set to true. • Enables types to be used directly as constants in Zeek script, allowing types to be passed into BIFs without aliasing. • Emits a new `lowercase_HTTP_keyword` weird when the HTTP analyzer encounters a non-uppercase HTTP-name field. • Adds the ZeroMQ cluster backend (introduced in 7.1) with correctness, performance, and robustness improvements; loadable via `@load frameworks/cluster/backend/zeromq/connect`. • Enables comparison of `pattern`-containing vectors with `==` and `!=` in scripts. • Populates the `ip_proto` field for connections encapsulated in tunnels. • Expands `Site::private_address_space` with additional non-routable subnets from RFCs 2365, 3058, 3879, and 5771. • Enables `--save-seeds` to put Zeek into deterministic mode, producing identical UIDs on a subsequent `--load-seeds` run. • Adds `DNS::skip_resp_host_port_pairs` option to `detect-external-names.zeek`; the script now also logs IPv6 results. • Includes ZeekJS documentation in the main Zeek docs at docs.zeek.org by default. • Enables libkrb5 support on all platforms (previously Linux-only). • The to_count() and to_int() built-in functions now trim trailing spaces from their argument. Breaking changes: • is_remote_event(), current_analyzer(), and current_event_time() (and their C++ `EventMgr` counterparts) now return `false`, `0`, or zero time (instead of the previous event's values) when event draining has completed. • to_int() now returns an error on invalid input instead of silently returning `0`, matching the behavior of to_count(). • Cluster::listen_websocket() has TLS disabled by default, whereas Broker::listen_websocket() defaulted to TLS enabled — switching will disable TLS unless a `WebSocketTLSOptions` record is passed or a TLS reverse proxy is used. • `Site::private_address_space` now includes `239.0.0.0/8`, `224.0.0.0/24`, `[2002:e000::]/40`, `[2002:ef00::]/24`, and `[fec0::]/10`, which may cause traffic previously considered non-local to be treated as local. • A protocol analyzer that raises a violation before confirmation is now immediately disabled; `DPD::max_violations` is no longer used (deprecated until Zeek 8.1). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.1.0

Mon, 16 Dec 2024 18:44:10 GMT

Zeek v7.1.0 adds PostgreSQL & StreamEvent analyzers, ZeroMQ cluster backend, and per-peer Broker backpressure controls. • Adds a PostgreSQL protocol analyzer enabled by default, generating `postgresql.log` with associated events. • Adds a `StreamEvent` pseudo protocol analyzer that exposes raw TCP stream data to the scripting layer via the new stream_deliver() event. • Adds an experimental ZeroMQ-based cluster backend as a drop-in alternative to Broker publish-subscribe. • Adds new Cluster::publish(), Cluster::subscribe(), and Cluster::unsubscribe() functions that operate on whichever cluster backend is enabled. • Logs previously invisible IP connections using unknown IP protocols (e.g. not TCP/UDP/ICMP) in `conn.log` with a new `ip_proto` column; optional `ip_proto_name` column available via policy script. • Adds per-peer Broker I/O buffer management with configurable overflow policies (`disconnect`, `drop_newest`, `drop_oldest`) and new tunables `peer_buffer_size`, `peer_overflow_policy`, `web_socket_buffer_size`, and `web_socket_overflow_policy`. • Adds backpressure disconnect telemetry via the new `zeek_broker_backpressure_disconnects_total` labeled counter metric. • Adds StartTLS support to the LDAP analyzer, enabling SSL inspection for connections negotiated via extended request/response. • Extends the LDAP analyzer to handle non-sealed GSS-API WRAP tokens. • Adds support for TKEY resource records (RFC 2390) to the DNS analyzer, with a new `dns_TKEY` event. • Adds a new `DNS_unknown_opcode` weird to report unrecognized DNS opcodes. • Extends the unknown_protocols() event and `unknown_protocol.log` to include the names of all packet analyzers used for processing. • Adds a mysql_user_change() event to the MySQL analyzer when a user changes mid-session via `COM_USER_CHANGE`. • Extends signature_match() and custom signature events with an optional `end_of_match` parameter indicating the end-of-match offset within `data`. • Adds a new InitPreExecution() plugin hook for AST introspection after ZAM optimizations, executing before zeek_init() is enqueued. • Adds SQLite journal mode and synchronous mode configuration to the SQLite logger, including WAL mode support via `LogSQLite::journal_mode`. • Adds experimental support for pluggable cluster backends and pluggable serialization formats for events and log-writes. • Ships an experimental Spicy-based SSL/TLS analyzer (disabled by default), enabling full SSL/TLS parsing via `--enable-spicy-ssl`. • Exposes the majority of `stats.log` metrics through the Telemetry framework and Prometheus output. • Adds `Log::flush_interval` and `Log::write_buffer_size` options to control batching and flushing for local log writers. • FTP `PASS` command logging in `ftp.log` now honors `FTP::default_capture_password`, blanking passwords with ``. Breaking changes: • The `OpaqueVal::DoSerialize` and `OpaqueVal::DoUnserialize` methods have been removed; plugins overriding them will fail to compile and must be updated to override `OpaqueVal::DoSerializeData` and `OpaqueVal::DoUnserializeData` instead. • Internal broker and logging class methods now accept `std::vector` instead of `threading::Value**`; plugins using these internal methods (not DoWrite()/HookLogWrite()) must be updated. • Func::Name() is deprecated; use Func::GetName() instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.0.1

Tue, 03 Sep 2024 22:48:20 GMT

Zeek v7.0.1 adds StartTLS support to the LDAP analyzer and improves GSS-API WRAP token handling. • Adds StartTLS support to the LDAP analyzer, enabling the SSL analyzer for connections that negotiate TLS via the extended request/response mechanism. • Supports handling of non-sealed GSS-API WRAP tokens in the LDAP analyzer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v7.0.0

Thu, 11 Jul 2024 21:09:21 GMT

Zeek v7.0 adds table/set/vector `delete`, can_load() helper, SMB2 PDU parsing, and Prometheus telemetry framework • `delete` statement now clears the contents of tables, sets, and vectors. • New can_load() helper function backed by bif find_in_zeekpath() allows guarding `@load` directives when script packages may or may not be installed. • Packagers can include a "local" addition into Zeek's version string via build flag `--localversion=XXX` and the `LOCALVERSION` environment variable for Docker builds. • SMB2 packets containing multiple PDUs now correctly parse all headers. • New built-in function lookup_connection_analyzer_id() retrieves the numeric identifier of an analyzer associated with a connection, enabling use of disable_analyzer() outside of confirmation/violation events. Breaking changes: • The Telemetry framework moved to a Prometheus-first model; `Broker::metrics_port` is now `Telemetry::metrics_port` and `Broker::metrics_export_endpoint_name` is now `Telemetry::metrics_endpoint_name`. • Options `Broker::metrics_export_interval`, `Broker::metrics_export_topic`, `Broker::metrics_import_topics`, and `Broker::metrics_export_prefixes` have been removed. • The `unit` field has been removed from the telemetry log. • All `BROKER_METRICS_*` environment variables have been removed. • Cluster configuration requires a new `metrics_port` field in each node's `node.cfg` options and the cluster layout record defined in `cluster-layout.zeek`. • Instruments no longer support `count` or `int64_t`; only `double` versions are provided. • The `is_sum` argument has been removed from the constructors/creation methods for all instruments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.2.1

Thu, 16 May 2024 17:41:07 GMT

Zeek v6.2.1 adds PacketFilter `remove_exclude` and `--localversion` configure flag • `PacketFilter` now includes `remove_exclude` function for removing filters by name • `configure` script supports `--localversion` to customize the version string output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.0.4

Thu, 16 May 2024 17:40:07 GMT

Zeek v6.0.4 introduces `remove_exclude` in PacketFilter and `--localversion` configure flag • Adds remove_exclude(name) function to the `PacketFilter` framework to remove a previously added exclude filter by name • Adds `--localversion` option to the `configure` script to append custom strings to the version reported by `zeek -v` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.2.0

Tue, 20 Feb 2024 20:17:28 GMT

Zeek v6.2.0 adds WebSocket analyzer with websocket.log, Log::delay() for deferred logging, and parallel pattern matching tables • Adds the `websocket.log` and new `Analyzer::ANALYZER_WEBSOCKET` to detect and analyze WebSocket traffic • Introduces Log::delay() and Log::delay_finish() functions to defer log record writes • Extends table types to allow parallel regular expression matching when the index is a pattern • Adds `Intel::seen_policy` hook to intercept and modify Intel framework behavior • Adds `NetControl::rule_added_policy` hook for post-addition NetControl rule modification • Makes MaxMind database paths configurable via `mmdb_city_db`, `mmdb_country_db`, `mmdb_asn_db` and the fallback path via `mmdb_dir_fallbacks` Breaking changes: • The `arguments`, `diagnostic_messages`, `objects`, `opcodes`, and `results` fields in `ldap.log` are renamed to their singular forms (`argument`, `diagnostic_message`, `object`, `opcode`, `result`) and changed from vectors/sets to scalars • The `base_objects`, `derefs`, `diagnostic_messages`, `results`, and `scopes` fields in `ldap_search.log` are renamed to their singular forms (`base_object`, `deref_aliases`, `diagnostic_message`, `result`, `scope`) and changed from vectors/sets to scalars • Zeek's `OPENSSL_INCLUDE_DIR` is not automatically added to an external plugin's include path anymore Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.0.3

Mon, 22 Jan 2024 16:41:26 GMT

Zeek v6.0.3 adds MIME::max_depth config to limit parser depth and fixes Ed25519/Ed448 DNS support • Adds `MIME::max_depth` configuration option to limit nested MIME entity parsing depth, generating an exceeded_mime_max_depth weird event when the limit is reached. • Updates DNS analyzer to understand Ed25519 and Ed448 signature algorithms for record validation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.0.2

Fri, 27 Oct 2023 19:51:06 GMT

v6.0.2 adds `SSL::max_alerts_per_record` and `SSL::max_ssl_history_length` to cap SSL DoS risks. • Adds `SSL::max_alerts_per_record` config option to cap alerts per SSL record (default 1 for TLS 1.3, configurable otherwise). • Adds `SSL::max_ssl_history_length` config option to cap `ssl.log` history field length (default 100 characters). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.1.0

Fri, 13 Oct 2023 18:57:19 GMT

Zeek v6.1.0 adds LDAP and QUIC protocol analyzers, new assert statement, &default_insert table attribute, and Pcap buffer sizing. • Adds the LDAP protocol analyzer (analyzes `LDAP_UDP` and `LDAP_TCP`, logs to `ldap.log` and `ldap_search.log`). • Adds the QUIC protocol analyzer for decrypting INITIAL packets of QUIC version 1, forwarding handshake data to SSL. • Introduces a new `assert [, ]` statement with assertion_failure() and assertion_result() hooks for runtime assertions. • Adds the `&default_insert` attribute for tables to insert default values on failed lookup. • Extends `as` keyword to support casting between `set` and `vector` values of the same element type. • New packet analyzer handles PCAP files with DLT_PPP link type. • Adds ModBus support for Encapsulation Interface Transport (function 28) and Diagnostics (function 8) via new events. • ModBus file record read/write events now provide full request/response data in event data. • Adds `full PDU length` to the `ModBusHeader` record type. • Adds connection_flipped() event to update custom state when connection directionality is flipped by heuristics. • Allows configuring max pending HTTP requests via new `HTTP::max_pending_requests` option (default 100). • Sets offline PCAP read buffer size to 128kb, configurable via `Pcap::bufsize_offline_bytes`. • Makes SSL alerts parsing configurable with new `SSL::max_alerts_per_record` and caps `ssl_history` via `SSL::max_ssl_history_length`. • Adds optional `key_func` argument to from_json() to normalize JSON object key names. Breaking changes: • The `assert` keyword is now reserved; using it as an identifier will break scripts. • The ``__bro_plugin__`` file generated during plugin builds is renamed to ``__zeek_plugin__``, breaking older `zkg` versions that rely on the old filename. • Zeek no longer traverses into dot directories in `ZEEK_PLUGIN_PATH` or `ZEEK_SPICY_MODULE_PATH`; plugins in such directories will be skipped. • External plugins requiring a CMake version below 3.15 will fail to configure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.0.1

Tue, 12 Sep 2023 20:46:31 GMT

Zeek v6.0.1 adds `default_limit_includes_missing`, `SMB::max_dce_rpc_analyzers`, connection_flipped() event, and auto community ID logging • Adds `default_limit_includes_missing` option to customize file size limit behavior when encountering large amounts of missed bytes • Adds `SMB::max_dce_rpc_analyzers` script variable to control the number of DCE-RPC analyzers per SMB connection • Adds connection_flipped() event to allow updating custom state when a connection's directionality is flipped • Auto-logs community ID when loading `policy/frameworks/notice/community-id.zeek` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v6.0.0

Wed, 31 May 2023 11:56:33 GMT

Zeek v6.0 adds native JavaScript support, built-in Spicy analyzers, Community ID bif, new event timestamp APIs, and multi-logger logging paths • Adds experimental JavaScript support via the `zeekJS` builtin plugin, enabling execution of `.js` and `.cjs` files with events like `zeek_init`. • Integrates Spicy analyzers directly into the Zeek code base (replacing the external plugin), allowing out-of-the-box use of Spicy-based analyzers such as Syslog and Finger. • Adds network timestamps to Zeek events, exposed via the new bif current_event_time() for retrieving the network time associated with a handler's execution context. • Introduces the from_json() bif to parse JSON strings into Zeek records with implicit type conversion. • Adds native Community ID support with the community_id_v1() bif and extends logs via new policy scripts `protocols/conn/community-id-logging` and `frameworks/notice/community-id`. • Extends ZeekControl's log archival logic to distinguish between multiple logger nodes by appending the logger's name to rotated file names, preventing data loss in multi-logger setups. • Adds the `-V` / `--build-info` command-line option to output verbose JSON about repository state and included plugins. • Exposes X.509 signature types in the certificate parser via a new field in the signed portion of the certificate. • Enhances SSL parsing with the `ssl_certificate_request` event, parse_distinguished_name() function, and policy script `protocols/ssl/certificate-request-info`. • Adds networking metrics (`zeek-net-dropped-packets`, etc.) via the telemetry framework when the `misc/stats` script is loaded. • Parses DNS AD ('authentic data') and CD ('checking disabled') flags from RFC 2535, making them available in the `dns_msg` record. • Enables the supervisor framework to start worker nodes that read from a trace file. • Adds `allow_network_time_forward=F` setting to prevent automatic updates of network_time() to current time. • Allows configuring Pcap idle timeout via the `Pcap::non_fd_timeout` setting (default 20usec). • Supports suppressing deprecation warnings in Zeek scripts using the new `@pragma` directive (`@pragma push ignore-deprecations` / `@pragma pop`). • Adds `pkts_filtered` field to the network statistics record type for reporting packets filtered by the interface before hand-off. Breaking changes: • Zeek treats private address space as local by default via `Site::private_address_space_is_local`; prior behavior can be restored with a redef to false. • Telemetry centralization and Prometheus exposition is disabled by default; must be manually re-enabled by loading `frameworks/telemetry/prometheus`. • Custom source tarballs now require a `repo-info.json` file at the top level for building. • Plugin authors must raise the minimum required CMake version to 3.15 for compatibility with new scaffolding. • Zeek container images are no longer pushed to the zeekurity organization; use `zeek/zeek` on DockerHub or `public.ecr.aws/zeek/zeek` instead. • The IRC_Data analyzer declaration is now located in `protocols/irc/IRC.h`. • Error messages for using `bro_init`, `bro_done`, and `bro_script_loaded` events are removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.2.1

Tue, 11 Apr 2023 19:54:49 GMT

Zeek v5.2.1 adds `Pcap::non_fd_timeout` and shifts default data stores from Broker to local. • Adds `Pcap::non_fd_timeout` script-level option to control sleep time for non-fd packet sources • Changes default data store for known-{hosts,certs,services} policies from Broker to local Breaking changes: • Known policy data stores now default to local instead of Broker, potentially affecting cluster synchronization behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.0.8

Tue, 11 Apr 2023 19:54:11 GMT

Adds `Pcap::non_fd_timeout` script option for tuning I/O sleep on non-fd packet sources • A new script-level option `Pcap::non_fd_timeout` allows fine-tuning the amount of time to sleep on each IO loop when using a packet source that doesn't provide a file descriptor (e.g. Myricom). The option defaults to 20 microseconds. • New wierds ``ayiya_empty_packet``, ``geneve_empty_packet``, and ``vxlan_empty_packet`` are added to report when packets containing these protocols do not have any further data after the tunnel header. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.2.0

Fri, 03 Feb 2023 17:51:59 GMT

Zeek v5.2.0 adds Windows support, runtime analyzer enable/disable, event groups, and AF_PACKET builtin • Adds experimental `zeek` binary for Microsoft Windows environments • Publishes container images to `zeek/zeek` and `zeek/zeek-dev` on Docker Hub • Adds `af_packet` as a default built-in packet source plugin on Linux • Adds `zeekctl` support for `lb_method=af_packet` • Introduces Analyzer::enable_analyzer() and Analyzer::disable_analyzer() BIFs • Re-introduces event groups via the `&group` attribute on handlers • Adds disable_event_group(), enable_event_group(), disable_module_events() and enable_module_events() BIFs • Extends `Logging::Stream` record with an `event_groups` field • Adds `AnalyzerConfirmationInfo` and `AnalyzerViolationInfo` record types • Adds `analyzer_confirmation_info` and `analyzer_violation_info` events • Adds helper BIFs is_protocol_analyzer(), is_packet_analyzer() and is_file_analyzer() • Adds AnalyzerViolation() method to file analyzers • Adds `Analyzer::requested_analyzers` set for analyzer control at init time • Creates new `analyzer.log` for logging analyzer violations and confirmations • Allows `SQLite` synchronous and journal_mode PRAGMAs configuration via Broker data stores • Adds `integrity_check` and `failure_mode` options for SQLite-backed Broker data stores • Adds join_string_set() BIF • Adds `&ordered` attribute for tables and sets • Adds `-D` argument to `configure` script for CMake parameters • Extends SSH analyzer with new events: `ssh2_ecc_init`, `ssh2_gh_gex_init`, `ssh2_gss_init`, `ssh2_rsa_secret` • Extends NTLM analyzer to parse challenge and response fields • Adds `FTP::max_command_length` script-level variable (default 100) and `FTP_max_command_length_exceeded` weird • MySQL analyzer detects SSL encrypted sessions, adding 'ssl' to service field in `conn.log` • Allows blank identifier `_` to ignore loop variables of different types without type clash errors • Supports trailing commas in table, vector, set, record construction, and function calls • Adds get_identifier_declaring_script() and get_record_field_declaring_script() BIFs • Updates DNS query type strings to standardized list (30: NXT, 31: EID, 32: NIMLOC) • Zeek exits at startup if an external plugin shares a name with a built-in plugin • Removes `--with-caf` option from `configure` script Breaking changes: • Network ports assigned to workers now start at port 27760, requiring firewall/routing updates for clusters not on FreeBSD • AF_PACKET plugin options (`af_packet_*`) are now integrated into `zeekctl`; users must upgrade `zeekctl` bundled with Zeek 5.2 • The blank identifier `_` can no longer be used in expressions and options, only to ignore loop variables • The `mysql_ok` event is no longer raised; users must switch to the new `mysql_eof` event • Zeek exits at startup if an external plugin has the same name as a built-in plugin • DNS query type string representations changed for types 30 (EID to NXT), 31 (NIMLOC to EID), and 32 (NB to NIMLOC) • The `--with-caf` configure option was removed; Broker now requires specific CAF versions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.0.6

Wed, 01 Feb 2023 17:18:04 GMT

Zeek v5.0.6 adds `file_over_new_connection` event and improves SMB/HTTP/DNS error handling • Adds the `file_over_new_connection` event to the Intel framework for files received over established connections like HTTP. • Introduces a new `smb_tree_connect_andx_response_without_tree` weird event for SMB1 packets missing an associated request. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.1.2

Wed, 01 Feb 2023 17:15:37 GMT

Zeek v5.1.2 adds file_over_new_connection event and new SMB warning. • Adds `file_over_new_connection` event to the Intel framework for handling files received over established connections like HTTP • Introduces a new weird event `smb_tree_connect_andx_response_without_tree` when receiving SMB1 packets with connect_andx_response without an associated request Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.1.0

Tue, 20 Sep 2022 19:56:28 GMT

Zeek v5.1.0 adds telemetry framework, vector iteration, and new BIFs for scripts. • Adds `telemetry.log` and `telemetry_histogram.log` streams for metric collection via the new `base/frameworks/telemetry` framework • Adds disabling_analyzer() hook to allow vetoing analyzer disabling decisions in scripts • Adds support for iterating over vector indices and values with for ( idx, value in vec ) syntax • Adds `&log` attribute redefinition on record fields, enabling patterns like `redef Notice::Info$email_dest -= { &log };` • Adds `max_changes_per_connection` option to limit `tunnel_changed` events and prevent log spam (default 5) • Adds new BIFs: table_keys(), table_values(), bytestring_to_float(), pow(), and bit-shift operators `<<` and `>>` • Adds Modbus log fields for PDU type, transaction ID, and unit ID • Adds support for TCP option 27 parsing • Adds new packet-analyzer for DLT_LINUX_SLL2 PCAP link type Breaking changes: • `Packet::{l2,l3}_checksummed` variables replaced by `Packet::l4_checksummed` • Dictionary and PDict classes converted to C++ templates, requiring plugin build updates • `files.log` no longer includes `tx_hosts`, `rx_hosts`, or `conn_uids` fields by default; use `uid` and `id` instead • `files.log` entries are now unrolled consistently across connections • Barnyard2 policy scripts removed without deprecation • Unified2 analyzer and accompanying scripts removed without deprecation • `packet_analysis::IP::ParsePacket` return value changed to enum values, potentially breaking package builds • Conditional directives (`@if`, etc.) cannot follow `if`, `for`, or `while` statements directly; braces are now required • `bro` symlink to `zeek` binary removed • `is_orig` field in SSL/TLS events renamed to `is_client` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v5.0.0

Fri, 03 Jun 2022 20:19:51 GMT

Zeek v5.0 adds a single-instance cluster management framework with zeek-client, TLS decryption, event tracing, and script profiling. • Adds `zeek-client` executable as the cluster management client for uploading configs, deploying them, checking node status, restarting nodes, and retrieving global identifiers. • Loads the cluster controller via `policy/frameworks/management/controller` and agents via `policy/frameworks/management/agent` to enable single-instance cluster setups on one machine. • Adds `--no-unused-warnings` CLI option to suppress warnings for unused functions, hooks, and event handlers; use `&is_used` attribute in scripts to suppress specific instances. • Adds `--profile-scripts[=file]` command-line option (default: stdout) that writes a TSV profile of every function body including call counts, CPU time, and memory allocated upon termination. • Adds `--event-trace` / `-E` command-line options to generate and replay event traces. • Adds experimental limited TLS decryption capabilities requiring the pre-master secret and supporting only `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` on TLS 1.2 connections. • Enables WebSocket support for external clients by calling Broker::listen_websocket(), which starts listening on port 9997 for JSON messages. • Adds new BiFs val_footprint() and global_container_footprints() as substitutes for the deprecated val_size() and global_sizes() to estimate memory consumption. • Adds `Supervisor::node_status` and `SupervisorControl::node_status` events to notify recipients when a stem process (re-)starts a node, indicating the node name and new PID. • Adds `--statedir` configure option to adjust the installation's persistent state directory, defaulting to `var/lib` under the Zeek installation root. • Provides `base/misc/installation.zeek` script to expose key directories of the Zeek installation. Breaking changes: • Zeek now requires at least CMake version 3.15.0. • If configured with included Spicy (default), Zeek now requires Flex >= 2.6, Bison >= 3.3, and GCC >= 8.3 or Clang >= 9.0. • The script-land ``union`` and ``timer`` types have been removed without deprecation. • Broker uses a new network backend incompatible with the pre-5.0 backend; Zeek 4.x will not be able to exchange events with Zeek 5.x. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek

Zeek v4.2.0

Wed, 05 Jan 2022 18:29:51 GMT

Zeek v4.2.0 adds ZAM script optimization, unprocessed packet capture, and HTTPS/SVCB DNS support • Experimental ZAM script execution compiler activated via `-O ZAM`. • New `--optimize-files` and `--optimize-funcs` flags to restrict ZAM or C++ compilation optimization to specific scripts or functions. • Packet analyzer framework gains protocol detection via `PacketAnalyzer::register_protocol_detection` in scripts and `PacketAnalyzer::DetectProtocol` in C++. • New `Plugin::HookUnprocessedPacket` plugin hook and `packet_not_processed` event for packets that bypass analysis. • CLI flag `-c` / `--capture-unprocessed` to dump packets that were not processed by any analyzer. • DNS analyzer supports SVCB and HTTPS types, generating `dns_SVCB` and `dns_HTTPS` events. • `find_str` and `rfind_str` bifs now accept case-insensitive search arguments. • JSON logger respects `LogAscii::json_include_unset_fields` to include unset "&optional" fields as null in logs. • Official Docker images available via `zeekurity/zeek` (release tags) and `zeekurity/zeek-dev` (latest master merge). • New cmake function zeek_plugin_scripts() for Zeek plugin build dependency tracking. Breaking changes: • Existing C++ types like `zeek::Analyzer::Tag` are merged into a single type `zeek::Tag`; plugins relying on distinct Tag types for overloading will fail to build and must replace all `zeek::*::Tag` usage with `zeek::Tag`. • The `-uu` flag for analyzing unused record fields has been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/zeek