Zeek Logo

Table of Contents

  • Get Started
    • Installing Zeek
      • Docker Images
      • Binary Packages
        • Linux
        • macOS
        • FreeBSD
        • OpenBSD
    • Quick Start Guide
      • Running Zeek
      • Live Traffic
      • Scripting
      • Managing Zeek
      • Clusters
      • Next Steps
    • Security Considerations
      • Protective Measures
    • Zeek Cluster Setup
      • Cluster Architecture
        • Architecture
        • Frontend Options
      • Cluster Configuration
        • Preparing to Set up a Cluster
        • Basic Cluster Configuration
        • AF_PACKET Cluster Configuration
        • PF_RING Cluster Configuration
    • Building from Source
      • Required Dependencies
      • Optional Dependencies
      • Retrieving the Sources
      • Configuring and Building
      • Cross Compiling
        • Prerequisites
        • Configuration and Compiling
  • About Zeek
    • What Is Zeek?
    • Why Zeek?
    • History
    • Architecture
    • Monitoring With Zeek
      • Detection and Response Workflow
      • Instrumentation and Collection
      • Storage and Review
  • Zeek Tutorial
    • Setup
    • Invoking Zeek
      • Providing Script Values
      • Finding More
    • Using Packages
      • Finding and Installing Packages
    • ZeekControl
      • Invoking zeekctl
      • Customizing Zeek in a Cluster Setting
    • Logs
      • Zeek Log Formats
      • Log Schemas
      • JSON logs
      • Analyzing Logs from Zeekctl
      • Zeek’s Core Logs
    • Zeek Scripting
      • The Basics
        • Why Script?
        • Zeek Events
        • Data Types
        • Visibility and Scope
        • Redefinitions
        • Functions
        • Understanding a Real Script
      • A More Complex Script
        • Reassembling HTTP Entities
        • Searching for Patterns
        • Modifying the Logs
      • JavaScript
        • Preamble
        • Enabling JavaScript
        • Hello World
        • Execution Model
        • Types
        • Examples
        • TypeScript
  • Zeek Reference
    • Common Logs
      • conn.log
        • Inspecting the conn.log
        • Understanding the Second conn.log Entry
        • Understanding the First conn.log Entry
        • The ip_proto Field
        • The uid and Other Fields
        • Conclusion
      • dns.log
        • Inspecting the dns.log
        • Understanding the Second dns.log Entry
        • Understanding the First dns.log Entry
        • The uid and Other Fields
        • Conclusion
      • http.log
        • Inspecting the http.log
        • Understanding the http.log Entry
        • Reviewing the Original Traffic
        • Conclusion
      • files.log
        • Inspecting the conn.log
        • Inspecting the http.log
        • Inspecting the files.log
        • Inspecting the Extracted File
        • Conclusion
      • ftp.log
        • Finding the ftp.log
        • Reconstructing the FTP Control Channel
        • Inspecting the ftp.log
        • Finding the Data Channel
        • Conclusion
      • ssl.log
        • Reviewing TLS Versions Seen on the Network
        • Preparing to Inspect the ssl.log
        • Inspecting the ssl.log When TLS 1.2 Applies
        • Inspecting the ssl.log When TLS 1.3 Applies
        • Inspecting the ssl.log When ESNI/ECH Applies
        • Leveraging JA3 and JA3S
        • Conclusion
      • x509.log
        • Inspecting the x509.log When TLS 1.2 Applies
        • Inspecting the x509.log When TLS 1.3 Applies
        • Conclusion
      • smtp.log
        • Inspecting SMTP Traffic
        • Inspecting the smtp.log
        • Inspecting Extracted Files
        • Inspecting Zeek Logs for Traffic to Port 465 TCP
        • Inspecting Zeek Logs for Traffic to Port 587 TCP
        • Other Email Protocols: IMAP over TLS
        • Other Email Protocols: POP over TLS
        • Conclusion
      • ssh.log
        • Lateral Movement
        • Failed Lateral Movement
        • Outbound Movement
        • Inbound Movement
        • Failed Movement
        • Conclusion
      • pe.log
        • Starting with conn.log
        • Continuing with http.log
        • Continuing with files.log
        • Continuing with pe.log
        • Reviewing the Extracted Binary
        • Conclusion
      • dhcp.log
        • DORA via Tcpdump
        • DORA via Tcpdump Verbose Mode
        • Acknowledgement via tshark
        • Zeek’s Rendition of DORA
        • Two UIDs
        • Enumerating DHCP Servers
        • Conclusion
      • ntp.log
        • NTP via tcpdump
        • NTP via tcpdump and tshark
        • NTP via Zeek
        • Identifying NTP Servers
        • Conclusion
      • SMB Logs (plus DCE-RPC, Kerberos, NTLM)
        • Introduction
        • Leveraging BZAR
        • Running the net user Command
        • Connecting to a SMB Share and Uploading a File
        • Connecting to a SMB Share and Downloading a File
        • Scheduling Mimikatz via the At Service
        • Reviewing the Packet Capture with tshark
        • Using PsExec to Retrieve a File from a Target
        • Conclusion
      • irc.log
        • Reconstructing an IRC Session
        • Port 6667 conn.log
        • Port 6667 irc.log
        • Port 6697 conn.log
        • Port 6697 ssl.log and x509.log
        • Port 31337 conn.log
        • Port 31337 irc.log
        • Botnet IRC Traffic
        • Conclusion
      • ldap.log and ldap_search.log
        • LDAP Protocol Overview
        • ldap.log
        • ldap_search.log
        • StartTLS
        • Conclusion
      • postgresql.log
        • Overview
        • Example
        • TLS
      • quic.log
        • Overview
        • Example
        • Conclusion
      • rdp.log
        • conn.log
        • rdp.log
        • ssl.log and x509.log
        • Running the Test
        • Conclusion
      • traceroute.log
        • traceroute.log
        • Conclusion
      • tunnel.log
        • Teredo
        • IP in IP
        • IP over IP via GRE
        • IPv4 in PPP in GRE in IPv4 in IPv6
        • Conclusion
      • known_*.log and software.log
        • known_certs.log
        • known_hosts.log
        • known_services.log
        • software.log
        • Conclusion
      • weird.log and notice.log
        • weird.log
        • notice.log
        • Investigating a weird.log and notice.log Entry
        • Conclusion
      • DPD & analyzer.log
        • One Specific Example
        • Decoding 21588
        • Assorted Examples
        • Conclusion
      • capture_loss.log and reporter.log
        • capture_loss.log
        • reporter.log
        • Conclusion
    • Zeek Scripting Language
      • Operators
        • Relational operators
        • Logical operators
        • Arithmetic operators
        • Bitwise operators
        • Set operators
        • Assignment operators
        • Record field operators
        • Pattern operators
        • Type casting
        • Other operators
      • Types
        • addr
        • any
        • bool
        • count
        • double
        • enum
        • event
        • file
        • function
        • hook
        • int
        • interval
        • opaque
        • pattern
        • port
        • record
        • set
        • string
        • subnet
        • table
        • time
        • vector
        • void
      • Attributes
        • &redef
        • &priority
        • &log
        • &optional
        • &default
        • &default_insert
        • &add_func
        • &delete_func
        • &expire_func
        • &read_expire
        • &write_expire
        • &create_expire
        • &on_change
        • &publish_on_change
        • &raw_output
        • &error_handler
        • &type_column
        • &backend
        • &broker_store
        • &broker_allow_complex_type
        • &ordered
        • &deprecated
        • &is_assigned
        • &is_used
        • &group
      • Declarations and Statements
        • Declarations
        • Statements
      • Directives
        • @DIR
        • @FILENAME
        • @deprecated
        • @load
        • @load-plugin
        • @load-sigs
        • @unload
        • @prefixes
        • @if
        • @ifdef
        • @ifndef
        • @else
        • @endif
        • @DEBUG
      • Event Semantics
        • Event Groups
        • Tracing Events
    • Scripting Frameworks
      • Broker Communication Framework
        • Cluster Layout / API
        • Data Management/Sharing Strategies
        • Broker Framework Examples
        • Cluster Framework Examples
        • Broker-backed Zeek Tables for Data Synchronization and Persistence
      • Cluster Framework
        • Zeek’s Cluster Components
        • Running a Zeek Cluster
        • Developing Scripts/Heuristics
      • Configuration Framework
        • Introduction
        • Declaring Options
        • Changing Options
        • Change Handlers
      • File Analysis Framework
        • Supported Protocols
        • File Lifecycle Events
        • File Type Identification
        • Adding Analysis
        • Input Framework Integration
      • Input Framework
        • Reading Data into Tables
        • Reading Data to Events
        • Data Readers
      • Intelligence Framework
        • Introduction
        • Quick Start
        • Architecture
      • Logging Framework
        • Terminology
        • Streams
        • Filters
        • Writers
      • Management Framework
        • Quickstart
        • Architecture and Terminology
        • A Visual Example
        • Goals and Relationship to ZeekControl
        • Running Controller and Agent
        • Node Operation and Outputs
        • Log Management
        • The zeek-client CLI
        • Common cluster management tasks
      • NetControl Framework
        • NetControl Architecture
        • NetControl API
        • NetControl Plugins
      • Notice Framework
        • Overview
        • Processing Notices
        • Raising Notices
        • Automated Suppression
        • Extending Notice Framework
        • Cluster Considerations
        • The Weird Log
      • Packet Analysis
        • The Flow of Packets
        • Packet Analyzer Configuration
        • Packet Analyzer API
      • Signature Framework
        • Basics
        • Signature Language for Network Traffic
        • Signature Language for File Content
        • Things to keep in mind when writing signatures
        • Options
        • So, how about using Snort signatures with Zeek?
      • Storage Framework
        • Terminology
        • Asynchronous Mode vs Synchronous Mode
        • Using the Storage Framework
        • Events
        • Notes for Built-in Backends
      • Summary Statistics
        • Overview
        • Terminology
        • Examples
      • Supervisor Framework
        • Simple Example
        • Supervised Cluster Example
        • Internal Architecture
        • Node Revival
      • Telemetry Framework
        • Metric Types
        • Cluster Considerations
        • Metrics Export
        • Examples of Metrics Application
      • TLS Decryption
        • Capturing and decrypting a trace file
        • Decrypting live traffic
        • TLS Decryption API
    • Script Index
      • Log Files
        • Network Protocols
        • Files
        • NetControl
        • Detection
        • Network Observations
        • Miscellaneous
        • Zeek Diagnostics
      • Notices
      • Packet Analyzers
        • Zeek::ARP
        • Zeek::AYIYA
        • Zeek::Ethernet
        • Zeek::FDDI
        • Zeek::Geneve
        • Zeek::GRE
        • Zeek::GTPv1
        • Zeek::IEEE802_11
        • Zeek::IEEE802_11_Radio
        • Zeek::IGMP
        • Zeek::IP
        • Zeek::IPTunnel
        • Zeek::LinuxSLL
        • Zeek::LinuxSLL2
        • Zeek::LLC
        • Zeek::MPLS
        • Zeek::NFLog
        • Zeek::NOVELL_802_3
        • Zeek::Null
        • Zeek::PBB
        • Zeek::PPP
        • Zeek::PPPoE
        • Zeek::PPPSerial
        • Zeek::Root
        • Zeek::Skip
        • Zeek::SNAP
        • Zeek::Teredo
        • Zeek::VLAN
        • Zeek::VNTag
        • Zeek::VXLAN
      • Protocol Analyzers
        • Zeek::BitTorrent
        • Zeek::Cluster_WebSocket
        • Zeek::ConnSize
        • Zeek::DCE_RPC
        • Zeek::DHCP
        • Zeek::DNP3
        • Zeek::DNS
        • Zeek::File
        • Zeek::Finger
        • Zeek::FTP
        • Zeek::Gnutella
        • Zeek::GSSAPI
        • Zeek::HTTP
        • Zeek::Ident
        • Zeek::IMAP
        • Zeek::IRC
        • Zeek::JavaScript
        • Zeek::KRB
        • Zeek::LDAP
        • Zeek::Login
        • Zeek::MIME
        • Zeek::Modbus
        • Zeek::MQTT
        • Zeek::MySQL
        • Zeek::NCP
        • Zeek::NetBIOS
        • Zeek::NTLM
        • Zeek::NTP
        • Zeek::PIA
        • Zeek::POP3
        • Zeek::PostgreSQL
        • Zeek::QUIC
        • Zeek::RADIUS
        • Zeek::RDP
        • Zeek::Redis
        • Zeek::RFB
        • Zeek::RPC
        • Zeek::SIP
        • Zeek::SMB
        • Zeek::SMTP
        • Zeek::SNMP
        • Zeek::SOCKS
        • Zeek::SSH
        • Zeek::SSL
        • Zeek::StreamEvent
        • Zeek::Syslog
        • Zeek::TCP
        • Zeek::WebSocket
        • Zeek::XMPP
        • Zeek::ZIP
      • File Analyzers
        • Zeek::FileDataEvent
        • Zeek::FileEntropy
        • Zeek::FileExtract
        • Zeek::FileHash
        • Zeek::PE
        • Zeek::X509
      • Module Index
      • Complete Script Index
        • base/init-bare.zeek
        • base/bif/const.bif.zeek
        • base/bif/types.bif.zeek
        • base/bif/zeek.bif.zeek
        • base/bif/communityid.bif.zeek
        • base/bif/stats.bif.zeek
        • base/bif/reporter.bif.zeek
        • base/bif/strings.bif.zeek
        • base/bif/option.bif.zeek
        • base/frameworks/supervisor/api.zeek
        • base/bif/supervisor.bif.zeek
        • base/bif/packet_analysis.bif.zeek
        • base/bif/CPP-load.bif.zeek
        • base/bif/mmdb.bif.zeek
        • base/bif/plugins/Zeek_SNMP.types.bif.zeek
        • base/bif/plugins/Zeek_KRB.types.bif.zeek
        • base/bif/telemetry_functions.bif.zeek
        • base/bif/telemetry_types.bif.zeek
        • base/bif/event.bif.zeek
        • base/packet-protocols/__load__.zeek
        • base/packet-protocols/main.zeek
        • base/frameworks/analyzer/main.zeek
        • base/frameworks/packet-filter/utils.zeek
        • base/bif/analyzer.bif.zeek
        • base/bif/file_analysis.bif.zeek
        • base/packet-protocols/root/__load__.zeek
        • base/packet-protocols/root/main.zeek
        • base/packet-protocols/ip/__load__.zeek
        • base/packet-protocols/ip/main.zeek
        • base/packet-protocols/skip/__load__.zeek
        • base/packet-protocols/skip/main.zeek
        • base/packet-protocols/ethernet/__load__.zeek
        • base/packet-protocols/ethernet/main.zeek
        • base/packet-protocols/fddi/__load__.zeek
        • base/packet-protocols/fddi/main.zeek
        • base/packet-protocols/ieee802_11/__load__.zeek
        • base/packet-protocols/ieee802_11/main.zeek
        • base/packet-protocols/ieee802_11_radio/__load__.zeek
        • base/packet-protocols/ieee802_11_radio/main.zeek
        • base/packet-protocols/linux_sll/__load__.zeek
        • base/packet-protocols/linux_sll/main.zeek
        • base/packet-protocols/linux_sll2/__load__.zeek
        • base/packet-protocols/linux_sll2/main.zeek
        • base/packet-protocols/nflog/__load__.zeek
        • base/packet-protocols/nflog/main.zeek
        • base/packet-protocols/null/__load__.zeek
        • base/packet-protocols/null/main.zeek
        • base/packet-protocols/ppp/__load__.zeek
        • base/packet-protocols/ppp/main.zeek
        • base/packet-protocols/ppp_serial/__load__.zeek
        • base/packet-protocols/ppp_serial/main.zeek
        • base/packet-protocols/pppoe/__load__.zeek
        • base/packet-protocols/pppoe/main.zeek
        • base/packet-protocols/vlan/__load__.zeek
        • base/packet-protocols/vlan/main.zeek
        • base/packet-protocols/mpls/__load__.zeek
        • base/packet-protocols/mpls/main.zeek
        • base/packet-protocols/pbb/__load__.zeek
        • base/packet-protocols/pbb/main.zeek
        • base/packet-protocols/vntag/__load__.zeek
        • base/packet-protocols/vntag/main.zeek
        • base/packet-protocols/udp/__load__.zeek
        • base/packet-protocols/udp/main.zeek
        • base/packet-protocols/tcp/__load__.zeek
        • base/packet-protocols/tcp/main.zeek
        • base/packet-protocols/icmp/__load__.zeek
        • base/packet-protocols/icmp/main.zeek
        • base/packet-protocols/igmp/__load__.zeek
        • base/packet-protocols/igmp/types.zeek
        • base/packet-protocols/igmp/spicy-events.zeek
        • base/packet-protocols/igmp/main.zeek
        • base/packet-protocols/llc/__load__.zeek
        • base/packet-protocols/llc/main.zeek
        • base/packet-protocols/novell_802_3/__load__.zeek
        • base/packet-protocols/novell_802_3/main.zeek
        • base/packet-protocols/snap/__load__.zeek
        • base/packet-protocols/snap/main.zeek
        • base/packet-protocols/gre/__load__.zeek
        • base/packet-protocols/gre/main.zeek
        • base/packet-protocols/iptunnel/__load__.zeek
        • base/packet-protocols/iptunnel/main.zeek
        • base/packet-protocols/ayiya/__load__.zeek
        • base/packet-protocols/ayiya/main.zeek
        • base/packet-protocols/geneve/__load__.zeek
        • base/packet-protocols/geneve/main.zeek
        • base/packet-protocols/vxlan/__load__.zeek
        • base/packet-protocols/vxlan/main.zeek
        • base/packet-protocols/teredo/__load__.zeek
        • base/packet-protocols/teredo/main.zeek
        • base/bif/plugins/Zeek_Teredo.events.bif.zeek
        • base/bif/plugins/Zeek_Teredo.functions.bif.zeek
        • base/protocols/conn/removal-hooks.zeek
        • base/packet-protocols/gtpv1/__load__.zeek
        • base/packet-protocols/gtpv1/main.zeek
        • base/bif/plugins/Zeek_GTPv1.events.bif.zeek
        • base/bif/plugins/Zeek_GTPv1.functions.bif.zeek
        • base/frameworks/spicy/init-bare.zeek
        • builtin-plugins/__preload__.zeek
        • base/init-frameworks-and-bifs.zeek
        • base/frameworks/logging/__load__.zeek
        • base/frameworks/logging/main.zeek
        • base/bif/logging.bif.zeek
        • base/frameworks/logging/postprocessors/__load__.zeek
        • base/frameworks/logging/postprocessors/scp.zeek
        • base/frameworks/logging/postprocessors/sftp.zeek
        • base/frameworks/logging/writers/ascii.zeek
        • base/frameworks/logging/writers/sqlite.zeek
        • base/frameworks/logging/writers/none.zeek
        • base/frameworks/broker/__load__.zeek
        • base/frameworks/broker/main.zeek
        • base/bif/comm.bif.zeek
        • base/bif/messaging.bif.zeek
        • base/frameworks/broker/store.zeek
        • base/bif/data.bif.zeek
        • base/bif/store.bif.zeek
        • base/frameworks/broker/log.zeek
        • base/frameworks/broker/backpressure.zeek
        • base/frameworks/supervisor/__load__.zeek
        • base/frameworks/supervisor/control.zeek
        • base/frameworks/supervisor/main.zeek
        • base/frameworks/cluster/pubsub.zeek
        • base/frameworks/cluster/types.zeek
        • base/bif/cluster.bif.zeek
        • base/frameworks/input/__load__.zeek
        • base/frameworks/input/main.zeek
        • base/bif/input.bif.zeek
        • base/frameworks/input/readers/ascii.zeek
        • base/frameworks/input/readers/raw.zeek
        • base/frameworks/input/readers/benchmark.zeek
        • base/frameworks/input/readers/binary.zeek
        • base/frameworks/input/readers/config.zeek
        • base/frameworks/input/readers/sqlite.zeek
        • base/frameworks/cluster/__load__.zeek
        • base/frameworks/cluster/main.zeek
        • base/frameworks/control/__load__.zeek
        • base/frameworks/control/main.zeek
        • base/bif/plugins/Zeek_Cluster_WebSocket.events.bif.zeek
        • base/frameworks/cluster/pools.zeek
        • base/utils/hash_hrw.zeek
        • base/frameworks/cluster/publish-on-change.zeek
        • base/bif/publish_on_change.bif.zeek
        • base/frameworks/cluster/telemetry.zeek
        • base/frameworks/config/__load__.zeek
        • base/frameworks/config/main.zeek
        • base/frameworks/config/input.zeek
        • base/frameworks/config/weird.zeek
        • base/frameworks/analyzer/__load__.zeek
        • base/frameworks/analyzer/dpd.zeek
        • base/frameworks/analyzer/logging.zeek
        • base/frameworks/files/__load__.zeek
        • base/frameworks/files/main.zeek
        • base/utils/site.zeek
        • base/utils/patterns.zeek
        • base/frameworks/files/magic/__load__.zeek
        • base/frameworks/telemetry/options.zeek
        • base/bif/__load__.zeek
        • base/bif/telemetry_consts.bif.zeek
        • base/bif/zeekygen.bif.zeek
        • base/bif/pcap.bif.zeek
        • base/bif/bloom-filter.bif.zeek
        • base/bif/cardinality-counter.bif.zeek
        • base/bif/top-k.bif.zeek
        • base/bif/zam-prof.bif.zeek
        • base/bif/storage.bif.zeek
        • base/bif/storage-async.bif.zeek
        • base/bif/storage-events.bif.zeek
        • base/bif/storage-sync.bif.zeek
        • base/bif/spicy.bif.zeek
        • base/bif/plugins/__load__.zeek
        • base/bif/plugins/Zeek_BitTorrent.events.bif.zeek
        • base/bif/plugins/Zeek_ConnSize.events.bif.zeek
        • base/bif/plugins/Zeek_ConnSize.functions.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.consts.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.types.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.events.bif.zeek
        • base/bif/plugins/Zeek_DHCP.events.bif.zeek
        • base/bif/plugins/Zeek_DHCP.types.bif.zeek
        • base/bif/plugins/Zeek_DNP3.events.bif.zeek
        • base/bif/plugins/Zeek_DNS.events.bif.zeek
        • base/bif/plugins/Zeek_File.events.bif.zeek
        • base/bif/plugins/Zeek_FTP.events.bif.zeek
        • base/bif/plugins/Zeek_FTP.functions.bif.zeek
        • base/bif/plugins/Zeek_Gnutella.events.bif.zeek
        • base/bif/plugins/Zeek_GSSAPI.events.bif.zeek
        • base/bif/plugins/Zeek_HTTP.events.bif.zeek
        • base/bif/plugins/Zeek_HTTP.functions.bif.zeek
        • base/bif/plugins/Zeek_Ident.events.bif.zeek
        • base/bif/plugins/Zeek_IMAP.events.bif.zeek
        • base/bif/plugins/Zeek_IRC.events.bif.zeek
        • base/bif/plugins/Zeek_KRB.events.bif.zeek
        • base/bif/plugins/Zeek_Login.events.bif.zeek
        • base/bif/plugins/Zeek_Login.functions.bif.zeek
        • base/bif/plugins/Zeek_MIME.consts.bif.zeek
        • base/bif/plugins/Zeek_MIME.events.bif.zeek
        • base/bif/plugins/Zeek_Modbus.events.bif.zeek
        • base/bif/plugins/Zeek_MQTT.types.bif.zeek
        • base/bif/plugins/Zeek_MQTT.events.bif.zeek
        • base/bif/plugins/Zeek_MySQL.events.bif.zeek
        • base/bif/plugins/Zeek_NCP.events.bif.zeek
        • base/bif/plugins/Zeek_NCP.consts.bif.zeek
        • base/bif/plugins/Zeek_NetBIOS.events.bif.zeek
        • base/bif/plugins/Zeek_NetBIOS.functions.bif.zeek
        • base/bif/plugins/Zeek_NTLM.types.bif.zeek
        • base/bif/plugins/Zeek_NTLM.events.bif.zeek
        • base/bif/plugins/Zeek_NTP.types.bif.zeek
        • base/bif/plugins/Zeek_NTP.events.bif.zeek
        • base/bif/plugins/Zeek_POP3.consts.bif.zeek
        • base/bif/plugins/Zeek_POP3.events.bif.zeek
        • base/bif/plugins/Zeek_RADIUS.events.bif.zeek
        • base/bif/plugins/Zeek_RDP.events.bif.zeek
        • base/bif/plugins/Zeek_RDP.types.bif.zeek
        • base/bif/plugins/Zeek_RFB.events.bif.zeek
        • base/bif/plugins/Zeek_RPC.events.bif.zeek
        • base/bif/plugins/Zeek_SIP.events.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_check_directory.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_close.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_create_directory.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_echo.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_logoff_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_negotiate.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_nt_create_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_nt_cancel.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_query_information.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_read_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_session_setup_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction_secondary.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction2.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction2_secondary.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_tree_connect_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_tree_disconnect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_write_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_events.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_close.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_create.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_negotiate.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_read.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_session_setup.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_set_info.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_tree_connect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_tree_disconnect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_write.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_transform_header.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_events.bif.zeek
        • base/bif/plugins/Zeek_SMB.events.bif.zeek
        • base/bif/plugins/Zeek_SMB.consts.bif.zeek
        • base/bif/plugins/Zeek_SMB.types.bif.zeek
        • base/bif/plugins/Zeek_SMTP.consts.bif.zeek
        • base/bif/plugins/Zeek_SMTP.events.bif.zeek
        • base/bif/plugins/Zeek_SMTP.functions.bif.zeek
        • base/bif/plugins/Zeek_SNMP.events.bif.zeek
        • base/bif/plugins/Zeek_SOCKS.events.bif.zeek
        • base/bif/plugins/Zeek_SSH.types.bif.zeek
        • base/bif/plugins/Zeek_SSH.events.bif.zeek
        • base/bif/plugins/Zeek_SSL.types.bif.zeek
        • base/bif/plugins/Zeek_SSL.events.bif.zeek
        • base/bif/plugins/Zeek_SSL.functions.bif.zeek
        • base/bif/plugins/Zeek_SSL.consts.bif.zeek
        • base/bif/plugins/Zeek_StreamEvent.events.bif.zeek
        • base/bif/plugins/Zeek_TCP.events.bif.zeek
        • base/bif/plugins/Zeek_TCP.types.bif.zeek
        • base/bif/plugins/Zeek_TCP.functions.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.consts.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.events.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.functions.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.types.bif.zeek
        • base/bif/plugins/Zeek_XMPP.events.bif.zeek
        • base/bif/plugins/Zeek_Cluster_Backend_ZeroMQ.cluster_backend_zeromq.bif.zeek
        • base/bif/plugins/Zeek_PPPoE.functions.bif.zeek
        • base/bif/plugins/Zeek_ARP.events.bif.zeek
        • base/bif/plugins/Zeek_UDP.events.bif.zeek
        • base/bif/plugins/Zeek_ICMP.events.bif.zeek
        • base/bif/plugins/Zeek_Geneve.events.bif.zeek
        • base/bif/plugins/Zeek_Geneve.functions.bif.zeek
        • base/bif/plugins/Zeek_VXLAN.events.bif.zeek
        • base/bif/plugins/Zeek_FileEntropy.events.bif.zeek
        • base/bif/plugins/Zeek_FileExtract.events.bif.zeek
        • base/bif/plugins/Zeek_FileExtract.functions.bif.zeek
        • base/bif/plugins/Zeek_FileHash.events.bif.zeek
        • base/bif/plugins/Zeek_PE.events.bif.zeek
        • base/bif/plugins/Zeek_X509.events.bif.zeek
        • base/bif/plugins/Zeek_X509.types.bif.zeek
        • base/bif/plugins/Zeek_X509.functions.bif.zeek
        • base/bif/plugins/Zeek_X509.ocsp_events.bif.zeek
        • base/bif/plugins/Zeek_AsciiReader.ascii.bif.zeek
        • base/bif/plugins/Zeek_BenchmarkReader.benchmark.bif.zeek
        • base/bif/plugins/Zeek_BinaryReader.binary.bif.zeek
        • base/bif/plugins/Zeek_ConfigReader.config.bif.zeek
        • base/bif/plugins/Zeek_RawReader.raw.bif.zeek
        • base/bif/plugins/Zeek_SQLiteReader.sqlite.bif.zeek
        • base/bif/plugins/Zeek_AF_Packet.af_packet.bif.zeek
        • base/bif/plugins/Zeek_AsciiWriter.ascii.bif.zeek
        • base/bif/plugins/Zeek_NoneWriter.none.bif.zeek
        • base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
        • base/bif/plugins/Zeek_JavaScript.zeekjs.bif.zeek
        • base/bif/plugins/Zeek_PacketSourceUDP.packet_source_udp.bif.zeek
        • base/frameworks/spicy/init-framework.zeek
        • base/init-default.zeek
        • base/utils/active-http.zeek
        • base/utils/exec.zeek
        • base/utils/addrs.zeek
        • base/utils/backtrace.zeek
        • base/utils/conn-ids.zeek
        • base/utils/dir.zeek
        • base/frameworks/reporter/__load__.zeek
        • base/frameworks/reporter/main.zeek
        • base/utils/paths.zeek
        • base/utils/directions-and-hosts.zeek
        • base/utils/email.zeek
        • base/utils/files.zeek
        • base/utils/geoip-distance.zeek
        • base/utils/numbers.zeek
        • base/utils/packages.zeek
        • base/utils/queue.zeek
        • base/utils/strings.zeek
        • base/utils/thresholds.zeek
        • base/utils/time.zeek
        • base/utils/urls.zeek
        • base/frameworks/notice/__load__.zeek
        • base/frameworks/notice/main.zeek
        • base/frameworks/notice/weird.zeek
        • base/frameworks/notice/actions/email_admin.zeek
        • base/frameworks/notice/actions/page.zeek
        • base/frameworks/notice/actions/add-geodata.zeek
        • base/frameworks/notice/actions/pp-alarms.zeek
        • base/frameworks/signatures/__load__.zeek
        • base/frameworks/signatures/main.zeek
        • base/frameworks/packet-filter/__load__.zeek
        • base/frameworks/packet-filter/main.zeek
        • base/frameworks/packet-filter/netstats.zeek
        • base/frameworks/software/__load__.zeek
        • base/frameworks/software/main.zeek
        • base/frameworks/intel/__load__.zeek
        • base/frameworks/intel/main.zeek
        • base/frameworks/intel/files.zeek
        • base/frameworks/intel/input.zeek
        • base/frameworks/sumstats/__load__.zeek
        • base/frameworks/sumstats/main.zeek
        • base/frameworks/sumstats/plugins/__load__.zeek
        • base/frameworks/sumstats/plugins/average.zeek
        • base/frameworks/sumstats/plugins/hll_unique.zeek
        • base/frameworks/sumstats/plugins/last.zeek
        • base/frameworks/sumstats/plugins/max.zeek
        • base/frameworks/sumstats/plugins/min.zeek
        • base/frameworks/sumstats/plugins/sample.zeek
        • base/frameworks/sumstats/plugins/std-dev.zeek
        • base/frameworks/sumstats/plugins/variance.zeek
        • base/frameworks/sumstats/plugins/sum.zeek
        • base/frameworks/sumstats/plugins/topk.zeek
        • base/frameworks/sumstats/plugins/unique.zeek
        • base/frameworks/sumstats/non-cluster.zeek
        • base/frameworks/tunnels/__load__.zeek
        • base/frameworks/tunnels/main.zeek
        • base/frameworks/openflow/__load__.zeek
        • base/frameworks/openflow/consts.zeek
        • base/frameworks/openflow/types.zeek
        • base/frameworks/openflow/main.zeek
        • base/frameworks/openflow/plugins/__load__.zeek
        • base/frameworks/openflow/plugins/ryu.zeek
        • base/frameworks/openflow/plugins/log.zeek
        • base/frameworks/openflow/plugins/broker.zeek
        • base/frameworks/openflow/non-cluster.zeek
        • base/frameworks/netcontrol/__load__.zeek
        • base/frameworks/netcontrol/types.zeek
        • base/frameworks/netcontrol/main.zeek
        • base/frameworks/netcontrol/plugin.zeek
        • base/frameworks/netcontrol/plugins/__load__.zeek
        • base/frameworks/netcontrol/plugins/debug.zeek
        • base/frameworks/netcontrol/plugins/openflow.zeek
        • base/frameworks/netcontrol/plugins/packetfilter.zeek
        • base/frameworks/netcontrol/plugins/broker.zeek
        • base/frameworks/netcontrol/plugins/acld.zeek
        • base/frameworks/netcontrol/drop.zeek
        • base/frameworks/netcontrol/shunt.zeek
        • base/frameworks/netcontrol/non-cluster.zeek
        • base/frameworks/telemetry/__load__.zeek
        • base/frameworks/telemetry/main.zeek
        • base/misc/version.zeek
        • base/frameworks/storage/__load__.zeek
        • base/frameworks/storage/async.zeek
        • base/frameworks/storage/main.zeek
        • base/frameworks/storage/sync.zeek
        • base/frameworks/spicy/__load__.zeek
        • base/frameworks/spicy/main.zeek
        • base/protocols/conn/__load__.zeek
        • base/protocols/conn/main.zeek
        • base/protocols/conn/contents.zeek
        • base/protocols/conn/inactivity.zeek
        • base/protocols/conn/polling.zeek
        • base/protocols/conn/thresholds.zeek
        • base/protocols/dce-rpc/__load__.zeek
        • base/protocols/dce-rpc/consts.zeek
        • base/protocols/dce-rpc/main.zeek
        • base/protocols/dhcp/__load__.zeek
        • base/protocols/dhcp/consts.zeek
        • base/protocols/dhcp/main.zeek
        • base/protocols/dnp3/__load__.zeek
        • base/protocols/dnp3/main.zeek
        • base/protocols/dnp3/consts.zeek
        • base/protocols/dns/__load__.zeek
        • base/protocols/dns/consts.zeek
        • base/protocols/dns/main.zeek
        • base/protocols/dns/check-event-handlers.zeek
        • base/protocols/finger/__load__.zeek
        • base/protocols/finger/spicy-events.zeek
        • base/protocols/finger/main.zeek
        • base/protocols/ftp/__load__.zeek
        • base/protocols/ftp/utils-commands.zeek
        • base/protocols/ftp/info.zeek
        • base/protocols/ftp/main.zeek
        • base/protocols/ftp/utils.zeek
        • base/protocols/ftp/files.zeek
        • base/protocols/ftp/gridftp.zeek
        • base/protocols/ssl/__load__.zeek
        • base/protocols/ssl/consts.zeek
        • base/protocols/ssl/main.zeek
        • base/protocols/ssl/mozilla-ca-list.zeek
        • base/protocols/ssl/ct-list.zeek
        • base/protocols/ssl/files.zeek
        • base/files/x509/__load__.zeek
        • base/files/x509/main.zeek
        • base/files/hash/__load__.zeek
        • base/files/hash/main.zeek
        • base/files/x509/certificate-event-cache.zeek
        • base/files/x509/log-ocsp.zeek
        • base/protocols/http/__load__.zeek
        • base/protocols/http/main.zeek
        • base/protocols/http/entities.zeek
        • base/protocols/http/utils.zeek
        • base/protocols/http/files.zeek
        • base/protocols/imap/__load__.zeek
        • base/protocols/imap/main.zeek
        • base/protocols/irc/__load__.zeek
        • base/protocols/irc/main.zeek
        • base/protocols/irc/dcc-send.zeek
        • base/protocols/irc/files.zeek
        • base/protocols/krb/__load__.zeek
        • base/protocols/krb/main.zeek
        • base/protocols/krb/consts.zeek
        • base/protocols/krb/files.zeek
        • base/protocols/ldap/__load__.zeek
        • base/protocols/ldap/spicy-events.zeek
        • base/protocols/ldap/consts.zeek
        • base/protocols/ldap/main.zeek
        • base/protocols/modbus/__load__.zeek
        • base/protocols/modbus/consts.zeek
        • base/protocols/modbus/main.zeek
        • base/protocols/mqtt/__load__.zeek
        • base/protocols/mqtt/consts.zeek
        • base/protocols/mqtt/main.zeek
        • base/protocols/mysql/__load__.zeek
        • base/protocols/mysql/main.zeek
        • base/protocols/mysql/consts.zeek
        • base/protocols/ntlm/__load__.zeek
        • base/protocols/ntlm/main.zeek
        • base/protocols/ntp/__load__.zeek
        • base/protocols/ntp/main.zeek
        • base/protocols/ntp/consts.zeek
        • base/protocols/pop3/__load__.zeek
        • base/protocols/postgresql/__load__.zeek
        • base/protocols/postgresql/consts.zeek
        • base/protocols/postgresql/spicy-events.zeek
        • base/protocols/postgresql/main.zeek
        • base/protocols/quic/__load__.zeek
        • base/protocols/quic/spicy-events.zeek
        • base/protocols/quic/consts.zeek
        • base/protocols/quic/main.zeek
        • base/protocols/radius/__load__.zeek
        • base/protocols/radius/main.zeek
        • base/protocols/radius/consts.zeek
        • base/protocols/rdp/__load__.zeek
        • base/protocols/rdp/consts.zeek
        • base/protocols/rdp/main.zeek
        • base/protocols/redis/__load__.zeek
        • base/protocols/redis/spicy-events.zeek
        • base/protocols/redis/main.zeek
        • base/protocols/rfb/__load__.zeek
        • base/protocols/rfb/main.zeek
        • base/protocols/sip/__load__.zeek
        • base/protocols/sip/main.zeek
        • base/protocols/snmp/__load__.zeek
        • base/protocols/snmp/main.zeek
        • base/protocols/smb/__load__.zeek
        • base/protocols/smb/consts.zeek
        • base/protocols/smb/const-dos-error.zeek
        • base/protocols/smb/const-nt-status.zeek
        • base/protocols/smb/main.zeek
        • base/protocols/smb/smb1-main.zeek
        • base/protocols/smb/smb2-main.zeek
        • base/protocols/smb/files.zeek
        • base/protocols/smtp/__load__.zeek
        • base/protocols/smtp/main.zeek
        • base/protocols/smtp/entities.zeek
        • base/protocols/smtp/files.zeek
        • base/protocols/socks/__load__.zeek
        • base/protocols/socks/consts.zeek
        • base/protocols/socks/main.zeek
        • base/protocols/ssh/__load__.zeek
        • base/protocols/ssh/main.zeek
        • base/protocols/syslog/__load__.zeek
        • base/protocols/syslog/spicy-events.zeek
        • base/protocols/syslog/consts.zeek
        • base/protocols/syslog/main.zeek
        • base/protocols/websocket/__load__.zeek
        • base/protocols/websocket/consts.zeek
        • base/protocols/websocket/main.zeek
        • base/protocols/tunnels/__load__.zeek
        • base/protocols/xmpp/__load__.zeek
        • base/protocols/xmpp/main.zeek
        • base/files/pe/__load__.zeek
        • base/files/pe/consts.zeek
        • base/files/pe/main.zeek
        • base/files/extract/__load__.zeek
        • base/files/extract/main.zeek
        • base/files/zip/__load__.zeek
        • base/files/zip/main.zeek
        • base/files/zip/types.zeek
        • base/misc/find-checksum-offloading.zeek
        • base/misc/find-filtered-trace.zeek
        • base/misc/installation.zeek
        • builtin-plugins/__load__.zeek
        • builtin-plugins/Zeek_JavaScript/__load__.zeek
        • builtin-plugins/Zeek_PacketSourceUDP/__load__.zeek
        • zeekygen/__load__.zeek
        • test-all-policy.zeek
        • policy/frameworks/analyzer/debug-logging.zeek
        • policy/frameworks/analyzer/detect-protocols.zeek
        • policy/frameworks/analyzer/packet-segment-logging.zeek
        • policy/frameworks/cluster/backend/broker/__load__.zeek
        • policy/frameworks/cluster/backend/broker/main.zeek
        • policy/frameworks/cluster/backend/broker/backpressure.zeek
        • policy/frameworks/cluster/backend/broker/telemetry.zeek
        • policy/frameworks/cluster/backend/zeromq/__load__.zeek
        • policy/frameworks/cluster/backend/zeromq/options.zeek
        • policy/frameworks/cluster/backend/zeromq/main.zeek
        • policy/frameworks/cluster/backend/zeromq/connect.zeek
        • policy/frameworks/cluster/experimental.zeek
        • policy/frameworks/management/agent/__load__.zeek
        • policy/frameworks/management/agent/api.zeek
        • policy/frameworks/management/types.zeek
        • policy/frameworks/management/agent/boot.zeek
        • policy/frameworks/management/agent/config.zeek
        • policy/frameworks/management/__load__.zeek
        • policy/frameworks/management/config.zeek
        • policy/frameworks/management/log.zeek
        • policy/frameworks/management/persistence.zeek
        • policy/frameworks/management/request.zeek
        • policy/frameworks/management/util.zeek
        • policy/frameworks/management/controller/config.zeek
        • policy/frameworks/management/controller/__load__.zeek
        • policy/frameworks/management/controller/api.zeek
        • policy/frameworks/management/controller/boot.zeek
        • policy/frameworks/management/node/api.zeek
        • policy/frameworks/management/node/config.zeek
        • policy/frameworks/management/supervisor/__load__.zeek
        • policy/frameworks/management/supervisor/main.zeek
        • policy/frameworks/management/supervisor/api.zeek
        • policy/frameworks/management/supervisor/config.zeek
        • policy/frameworks/intel/do_notice.zeek
        • policy/frameworks/intel/do_expire.zeek
        • policy/frameworks/intel/whitelist.zeek
        • policy/frameworks/intel/removal.zeek
        • policy/frameworks/intel/seen/__load__.zeek
        • policy/frameworks/intel/seen/conn-established.zeek
        • policy/frameworks/intel/seen/where-locations.zeek
        • policy/frameworks/intel/seen/dns.zeek
        • policy/frameworks/intel/seen/file-hashes.zeek
        • policy/frameworks/intel/seen/file-names.zeek
        • policy/frameworks/intel/seen/http-headers.zeek
        • policy/frameworks/intel/seen/http-url.zeek
        • policy/frameworks/intel/seen/pubkey-hashes.zeek
        • policy/frameworks/intel/seen/ssl.zeek
        • policy/frameworks/intel/seen/smb-filenames.zeek
        • policy/frameworks/intel/seen/smtp.zeek
        • policy/frameworks/intel/seen/smtp-url-extraction.zeek
        • policy/frameworks/intel/seen/x509.zeek
        • policy/frameworks/intel/seen/manage-event-groups.zeek
        • policy/frameworks/netcontrol/catch-and-release.zeek
        • policy/frameworks/files/detect-MHR.zeek
        • policy/frameworks/files/hash-all-files.zeek
        • policy/frameworks/files/entropy-test-all-files.zeek
        • policy/frameworks/notice/__load__.zeek
        • policy/frameworks/notice/extend-email/hostnames.zeek
        • policy/frameworks/notice/actions/drop.zeek
        • policy/frameworks/notice/community-id.zeek
        • policy/protocols/conn/community-id-logging.zeek
        • policy/files/x509/disable-certificate-events-known-certs.zeek
        • policy/files/zip/register.zeek
        • policy/frameworks/packet-filter/shunt.zeek
        • policy/frameworks/software/version-changes.zeek
        • policy/frameworks/software/vulnerable.zeek
        • policy/frameworks/software/windows-version-detection.zeek
        • policy/frameworks/storage/backend/redis/__load__.zeek
        • policy/frameworks/storage/backend/redis/main.zeek
        • policy/frameworks/storage/backend/sqlite/__load__.zeek
        • policy/frameworks/storage/backend/sqlite/main.zeek
        • policy/frameworks/telemetry/log.zeek
        • policy/integration/collective-intel/__load__.zeek
        • policy/integration/collective-intel/main.zeek
        • policy/misc/capture-loss.zeek
        • policy/misc/detect-traceroute/__load__.zeek
        • policy/misc/detect-traceroute/main.zeek
        • policy/misc/loaded-scripts.zeek
        • policy/misc/profiling.zeek
        • policy/misc/stats.zeek
        • policy/misc/weird-stats.zeek
        • policy/misc/trim-trace-file.zeek
        • policy/misc/unknown-protocols.zeek
        • policy/protocols/conn/disable-unknown-ip-proto-support.zeek
        • policy/protocols/conn/failed-service-logging.zeek
        • policy/protocols/conn/ip-proto-name-logging.zeek
        • policy/protocols/conn/known-hosts.zeek
        • policy/protocols/conn/known-services.zeek
        • policy/protocols/conn/mac-logging.zeek
        • policy/protocols/conn/multicast-participants.zeek
        • policy/protocols/conn/vlan-logging.zeek
        • policy/protocols/conn/pppoe-session-id-logging.zeek
        • policy/protocols/conn/weirds.zeek
        • policy/protocols/dhcp/msg-orig.zeek
        • policy/protocols/dhcp/software.zeek
        • policy/protocols/dhcp/sub-opts.zeek
        • policy/protocols/dns/auth-addl.zeek
        • policy/protocols/dns/detect-external-names.zeek
        • policy/protocols/dns/log-original-query-case.zeek
        • policy/protocols/ftp/detect-bruteforcing.zeek
        • policy/protocols/ftp/detect.zeek
        • policy/protocols/ftp/software.zeek
        • policy/protocols/http/detect-sql-injection.zeek
        • policy/protocols/http/detect-webapps.zeek
        • policy/protocols/http/header-names.zeek
        • policy/protocols/http/software-browser-plugins.zeek
        • policy/protocols/http/software.zeek
        • policy/protocols/http/var-extraction-cookies.zeek
        • policy/protocols/http/var-extraction-uri.zeek
        • policy/protocols/krb/ticket-logging.zeek
        • policy/protocols/krb/md5-ticket-logging.zeek
        • policy/protocols/modbus/known-masters-slaves.zeek
        • policy/protocols/modbus/track-memmap.zeek
        • policy/protocols/mysql/software.zeek
        • policy/protocols/rdp/indicate_ssl.zeek
        • policy/protocols/smb/log-cmds.zeek
        • policy/protocols/smtp/blocklists.zeek
        • policy/protocols/smtp/detect-suspicious-orig.zeek
        • policy/protocols/smtp/entities-excerpt.zeek
        • policy/protocols/smtp/software.zeek
        • policy/protocols/ssh/detect-bruteforcing.zeek
        • policy/protocols/ssh/geo-data.zeek
        • policy/protocols/ssh/interesting-hostnames.zeek
        • policy/protocols/ssh/md5-host-key-logging.zeek
        • policy/protocols/ssh/software.zeek
        • policy/protocols/ssl/certificate-request-info.zeek
        • policy/protocols/ssl/decryption.zeek
        • policy/protocols/ssl/expiring-certs.zeek
        • policy/protocols/ssl/heartbleed.zeek
        • policy/protocols/ssl/known-certs.zeek
        • policy/protocols/ssl/log-certs-base64.zeek
        • policy/protocols/ssl/ssl-log-ext.zeek
        • policy/protocols/ssl/log-hostcerts-only.zeek
        • policy/protocols/ssl/validate-certs.zeek
        • policy/protocols/ssl/validate-ocsp.zeek
        • policy/protocols/ssl/validate-sct.zeek
        • policy/protocols/ssl/weak-keys.zeek
        • policy/tuning/json-logs.zeek
        • policy/tuning/track-all-assets.zeek
        • policy/frameworks/conn_key/vlan_fivetuple.zeek
        • policy/frameworks/cluster/nodes-experimental/manager.zeek
        • policy/frameworks/cluster/websocket/server.zeek
        • policy/frameworks/control/controllee.zeek
        • policy/frameworks/control/controller.zeek
        • policy/frameworks/management/agent/main.zeek
        • policy/frameworks/management/controller/main.zeek
        • policy/frameworks/management/node/__load__.zeek
        • policy/frameworks/management/node/main.zeek
        • policy/frameworks/files/extract-all-files.zeek
        • policy/frameworks/signatures/iso-9660.zeek
        • policy/misc/dump-events.zeek
        • policy/misc/systemd-generator.zeek
        • base/frameworks/cluster/nodes/logger.zeek
        • policy/protocols/conn/speculative-service.zeek
        • policy/protocols/dns/disable-opcode-log-fields.zeek
        • policy/frameworks/spicy/resource-usage.zeek
        • zeekygen/example.zeek
  • Popular Customizations
    • Log Enrichment
      • Community ID
      • Address geolocation and AS lookups
        • Building Zeek with libmaxminddb
        • Installing and configuring GeoIP databases
        • Querying the databases
        • Testing
        • Example
    • Log Writers
      • Kafka
    • Logging
      • JSON Streaming Logs
      • Long Connections
    • Profiling and Debugging
      • jemalloc profiling
  • Advanced Topics
    • Troubleshooting
      • Memory Leaks and State Growth
        • Jemalloc Memory Profiling
      • CPU Profiling
        • Perf and Flame Graphs
      • Metrics and Stats
        • Telemetry Framework and Prometheus
        • stats.log
        • prof.log
    • Scripting
      • Use of conn_id_ctx
      • Script Optimization
        • Introduction
        • Other Optimization Features
      • Finding Potential Usage Errors
    • Developer Guides
      • Writing Plugins
        • Quick Start
        • Plugin Directory Layout
        • init-plugin
        • Activating a Plugin
        • Plugin Components
        • Testing Plugins
        • Debugging Plugins
        • Building Plugins Statically into Zeek
        • Plugin Tutorials
      • Writing Analyzers with Spicy
        • Installation
        • Getting Started
        • Tutorial
        • Reference
        • FAQ
        • Terminology
      • Interacting with Zeek using WebSockets
        • Introduction
        • Background and Setup
        • Version 1
        • Outgoing Connections
      • Contributor’s Guide
        • General Contribution Process
        • Coding Style and Conventions
        • General Documentation Structure/Process
        • Documentation Style and Conventions
        • Checking for Memory Errors and Leaks
        • Maintaining long-lived forks of Zeek
      • Maintainer’s Guide
        • Release Process
      • Cluster Architectures
        • Introduction
        • Single Node Examples
        • Multi Node Examples
        • WebSocket API to the Publish/Subscribe Layer
        • Operational Metrics via Prometheus
      • Spawning a Cluster
        • Introduction
        • Cluster Layout
        • Spawning Processes
        • Minimal Shell-Based Supervisor
      • ZeroMQ Cluster Backend
        • Quickstart
        • Architecture
        • Encryption
      • Connection Handling
        • Checksum Behavior
        • Flipping Connections
    • Subcomponents
  • Acknowledgements
Index
Zeek
  • Advanced Topics
  • Developer Guides
  • View page source

Developer Guides

In addition to documentation found or mentioned below, some developer-oriented content is maintained directly in the Zeek wiki due to the nature of the content (e.g. the author finds it to be more dynamic, informal, meta, transient, etc. compared to other documentation).

For more information about the documentation itself, see the doc directory within the Zeek source tree here.

  • Writing Plugins
    • Quick Start
    • Plugin Directory Layout
    • init-plugin
    • Activating a Plugin
    • Plugin Components
    • Testing Plugins
    • Debugging Plugins
    • Building Plugins Statically into Zeek
    • Plugin Tutorials
  • Writing Analyzers with Spicy
    • Installation
    • Getting Started
    • Tutorial
    • Reference
    • FAQ
    • Terminology
  • Interacting with Zeek using WebSockets
    • Introduction
    • Background and Setup
    • Version 1
    • Outgoing Connections
  • Contributor’s Guide
    • General Contribution Process
    • Coding Style and Conventions
    • General Documentation Structure/Process
    • Documentation Style and Conventions
    • Checking for Memory Errors and Leaks
    • Maintaining long-lived forks of Zeek
  • Maintainer’s Guide
    • Release Process
  • Cluster Architectures
    • Introduction
    • Single Node Examples
    • Multi Node Examples
    • WebSocket API to the Publish/Subscribe Layer
    • Operational Metrics via Prometheus
  • Spawning a Cluster
    • Introduction
    • Cluster Layout
    • Spawning Processes
    • Minimal Shell-Based Supervisor
  • ZeroMQ Cluster Backend
    • Quickstart
    • Architecture
    • Encryption
  • Connection Handling
    • Checksum Behavior
    • Flipping Connections
Previous Next

© Copyright by the Zeek Project. Last updated on May 19, 2026.

Built with Sphinx using a theme provided by Read the Docs.