Zeek

Zeek was originally known as Bro, a name derived from George Orwell's 1984 character Big Brother. The open-source project was officially renamed to Zeek in 2018 to avoid unintentional offensive connotations associated with the word. The renaming did not change the core functionality of the network security monitor.

While Zeek is often compared to Snort or Suricata, it is fundamentally a network analysis framework rather than a purely signature-based IDS. Zeek generates highly detailed, structured logs about network activity, which can then be fed into SIEMs or analyzed by other IDS tools. It focuses on deep protocol analysis and behavioral anomalies rather than just simple packet dropping.

The software was originally developed in the 1990s by Vern Paxson while he was at the Lawrence Berkeley National Laboratory. It was designed to investigate network traffic anomalies and was later funded heavily by the National Science Foundation. Today, it is maintained by the open-source community and the commercial company Corelight.

Custom logic and policies in Zeek are written using its own proprietary, Turing-complete scripting language. This specialized language allows administrators to extract specific metadata from network packets and trigger custom alerts. It enables deep, highly specific analysis of complex network protocols that off-the-shelf tools might miss.