Zeek and Suricata
The Zeek Project; Open Information Security Foundation (OISF) · Zeek 8 / Suricata 8 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs — connections, HTTP requests, DNS queries, TLS handshakes, files seen — using its own scripting language. Suricata, from OISF, is a signature and rule-driven IDS/IPS that also produces rich EVE JSON records and can extract files.
Who it is for, and when
Zeek is the right tool when you need a durable, queryable summary of what happened on a network over weeks — its conn.log and dns.log are the network equivalent of a file system timeline, and they survive long after a full packet capture would have rolled over. Suricata is for detection against known-bad indicators and for alerting in near real time, with rulesets that can be cited by name. Most mature network forensics environments run both and keep the logs, because the logs are what is still available when a matter surfaces months later. Suricata's documentation lives at docs.suricata.io.
What it does not cover
Neither is a packet analyser: Zeek discards the payload it summarised and Suricata keeps only what a rule told it to, so if you need the actual bytes you needed a full capture and Wireshark. Suricata detects what its rules describe and is blind to everything else; Zeek detects nothing by default and only records. Both require deployment at a network vantage point before the incident — neither can be applied retroactively.
Go to the source
Open at docs.zeek.org (opens in a new tab)https://docs.zeek.org/
Details
- Type
- Tool
- Written for
- AdvancedWorking examinerAdvanced, Working examiner
- Publisher
- The Zeek Project; Open Information Security Foundation (OISF)
- Version verified
- Zeek 8 / Suricata 8
- Year
- 2026
- Topics
- network, threat-hunting, log-analysis, incident-response, malware, open-source
- Checked at source
Related entries
A daily handler diary — distinct from the SANS DFIR blog — in which a rotating roster of volunteer handlers writes up whatever they are currently seeing in honeypot data, malware samples, exploit traffic and log telemetry.
CyberDefenders
Partly freeA blue-team lab platform hosting scenario-based investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat hunting, detection engineering and threat intelligence. Challenges are question-and-answer over supplied evidence, with a scoreboard.
How to build and run network security monitoring: where to place sensors, what to collect (full packet capture, session data, alert data), and how to work a case from an alert through the collected evidence to a conclusion about scope.
Sigma
FreeAn open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.
Timesketch
FreeAn open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once. It ingests Plaso storage files, CSV, and JSONL. The project states plainly that it is code owned by Google rather than an official Google product.