Zeek Logo

Table of Contents

  • Get Started
    • Installing Zeek
      • Docker Images
      • Binary Packages
        • Linux
        • macOS
        • FreeBSD
        • OpenBSD
    • Quick Start Guide
      • Running Zeek
      • Live Traffic
      • Scripting
      • Managing Zeek
      • Clusters
      • Next Steps
    • Security Considerations
      • Protective Measures
    • Zeek Cluster Setup
      • Cluster Architecture
        • Architecture
        • Frontend Options
      • Cluster Configuration
        • Preparing to Set up a Cluster
        • Basic Cluster Configuration
        • AF_PACKET Cluster Configuration
        • PF_RING Cluster Configuration
    • Building from Source
      • Required Dependencies
      • Optional Dependencies
      • Retrieving the Sources
      • Configuring and Building
      • Cross Compiling
        • Prerequisites
        • Configuration and Compiling
  • About Zeek
    • What Is Zeek?
    • Why Zeek?
    • History
    • Architecture
    • Monitoring With Zeek
      • Detection and Response Workflow
      • Instrumentation and Collection
      • Storage and Review
  • Zeek Tutorial
    • Setup
    • Invoking Zeek
      • Providing Script Values
      • Finding More
    • Using Packages
      • Finding and Installing Packages
    • ZeekControl
      • Invoking zeekctl
      • Customizing Zeek in a Cluster Setting
    • Logs
      • Zeek Log Formats
      • Log Schemas
      • JSON logs
      • Analyzing Logs from Zeekctl
      • Zeek’s Core Logs
    • Zeek Scripting
      • The Basics
        • Why Script?
        • Zeek Events
        • Data Types
        • Visibility and Scope
        • Redefinitions
        • Functions
        • Understanding a Real Script
      • A More Complex Script
        • Reassembling HTTP Entities
        • Searching for Patterns
        • Modifying the Logs
      • JavaScript
        • Preamble
        • Enabling JavaScript
        • Hello World
        • Execution Model
        • Types
        • Examples
        • TypeScript
  • Zeek Reference
    • Common Logs
      • conn.log
        • Inspecting the conn.log
        • Understanding the Second conn.log Entry
        • Understanding the First conn.log Entry
        • The ip_proto Field
        • The uid and Other Fields
        • Conclusion
      • dns.log
        • Inspecting the dns.log
        • Understanding the Second dns.log Entry
        • Understanding the First dns.log Entry
        • The uid and Other Fields
        • Conclusion
      • http.log
        • Inspecting the http.log
        • Understanding the http.log Entry
        • Reviewing the Original Traffic
        • Conclusion
      • files.log
        • Inspecting the conn.log
        • Inspecting the http.log
        • Inspecting the files.log
        • Inspecting the Extracted File
        • Conclusion
      • ftp.log
        • Finding the ftp.log
        • Reconstructing the FTP Control Channel
        • Inspecting the ftp.log
        • Finding the Data Channel
        • Conclusion
      • ssl.log
        • Reviewing TLS Versions Seen on the Network
        • Preparing to Inspect the ssl.log
        • Inspecting the ssl.log When TLS 1.2 Applies
        • Inspecting the ssl.log When TLS 1.3 Applies
        • Inspecting the ssl.log When ESNI/ECH Applies
        • Leveraging JA3 and JA3S
        • Conclusion
      • x509.log
        • Inspecting the x509.log When TLS 1.2 Applies
        • Inspecting the x509.log When TLS 1.3 Applies
        • Conclusion
      • smtp.log
        • Inspecting SMTP Traffic
        • Inspecting the smtp.log
        • Inspecting Extracted Files
        • Inspecting Zeek Logs for Traffic to Port 465 TCP
        • Inspecting Zeek Logs for Traffic to Port 587 TCP
        • Other Email Protocols: IMAP over TLS
        • Other Email Protocols: POP over TLS
        • Conclusion
      • ssh.log
        • Lateral Movement
        • Failed Lateral Movement
        • Outbound Movement
        • Inbound Movement
        • Failed Movement
        • Conclusion
      • pe.log
        • Starting with conn.log
        • Continuing with http.log
        • Continuing with files.log
        • Continuing with pe.log
        • Reviewing the Extracted Binary
        • Conclusion
      • dhcp.log
        • DORA via Tcpdump
        • DORA via Tcpdump Verbose Mode
        • Acknowledgement via tshark
        • Zeek’s Rendition of DORA
        • Two UIDs
        • Enumerating DHCP Servers
        • Conclusion
      • ntp.log
        • NTP via tcpdump
        • NTP via tcpdump and tshark
        • NTP via Zeek
        • Identifying NTP Servers
        • Conclusion
      • SMB Logs (plus DCE-RPC, Kerberos, NTLM)
        • Introduction
        • Leveraging BZAR
        • Running the net user Command
        • Connecting to a SMB Share and Uploading a File
        • Connecting to a SMB Share and Downloading a File
        • Scheduling Mimikatz via the At Service
        • Reviewing the Packet Capture with tshark
        • Using PsExec to Retrieve a File from a Target
        • Conclusion
      • irc.log
        • Reconstructing an IRC Session
        • Port 6667 conn.log
        • Port 6667 irc.log
        • Port 6697 conn.log
        • Port 6697 ssl.log and x509.log
        • Port 31337 conn.log
        • Port 31337 irc.log
        • Botnet IRC Traffic
        • Conclusion
      • ldap.log and ldap_search.log
        • LDAP Protocol Overview
        • ldap.log
        • ldap_search.log
        • StartTLS
        • Conclusion
      • postgresql.log
        • Overview
        • Example
        • TLS
      • quic.log
        • Overview
        • Example
        • Conclusion
      • rdp.log
        • conn.log
        • rdp.log
        • ssl.log and x509.log
        • Running the Test
        • Conclusion
      • traceroute.log
        • traceroute.log
        • Conclusion
      • tunnel.log
        • Teredo
        • IP in IP
        • IP over IP via GRE
        • IPv4 in PPP in GRE in IPv4 in IPv6
        • Conclusion
      • known_*.log and software.log
        • known_certs.log
        • known_hosts.log
        • known_services.log
        • software.log
        • Conclusion
      • weird.log and notice.log
        • weird.log
        • notice.log
        • Investigating a weird.log and notice.log Entry
        • Conclusion
      • DPD & analyzer.log
        • One Specific Example
        • Decoding 21588
        • Assorted Examples
        • Conclusion
      • capture_loss.log and reporter.log
        • capture_loss.log
        • reporter.log
        • Conclusion
    • Zeek Scripting Language
      • Operators
        • Relational operators
        • Logical operators
        • Arithmetic operators
        • Bitwise operators
        • Set operators
        • Assignment operators
        • Record field operators
        • Pattern operators
        • Type casting
        • Other operators
      • Types
        • addr
        • any
        • bool
        • count
        • double
        • enum
        • event
        • file
        • function
        • hook
        • int
        • interval
        • opaque
        • pattern
        • port
        • record
        • set
        • string
        • subnet
        • table
        • time
        • vector
        • void
      • Attributes
        • &redef
        • &priority
        • &log
        • &optional
        • &default
        • &default_insert
        • &add_func
        • &delete_func
        • &expire_func
        • &read_expire
        • &write_expire
        • &create_expire
        • &on_change
        • &publish_on_change
        • &raw_output
        • &error_handler
        • &type_column
        • &backend
        • &broker_store
        • &broker_allow_complex_type
        • &ordered
        • &deprecated
        • &is_assigned
        • &is_used
        • &group
      • Declarations and Statements
        • Declarations
        • Statements
      • Directives
        • @DIR
        • @FILENAME
        • @deprecated
        • @load
        • @load-plugin
        • @load-sigs
        • @unload
        • @prefixes
        • @if
        • @ifdef
        • @ifndef
        • @else
        • @endif
        • @DEBUG
      • Event Semantics
        • Event Groups
        • Tracing Events
    • Scripting Frameworks
      • Broker Communication Framework
        • Cluster Layout / API
        • Data Management/Sharing Strategies
        • Broker Framework Examples
        • Cluster Framework Examples
        • Broker-backed Zeek Tables for Data Synchronization and Persistence
      • Cluster Framework
        • Zeek’s Cluster Components
        • Running a Zeek Cluster
        • Developing Scripts/Heuristics
      • Configuration Framework
        • Introduction
        • Declaring Options
        • Changing Options
        • Change Handlers
      • File Analysis Framework
        • Supported Protocols
        • File Lifecycle Events
        • File Type Identification
        • Adding Analysis
        • Input Framework Integration
      • Input Framework
        • Reading Data into Tables
        • Reading Data to Events
        • Data Readers
      • Intelligence Framework
        • Introduction
        • Quick Start
        • Architecture
      • Logging Framework
        • Terminology
        • Streams
        • Filters
        • Writers
      • Management Framework
        • Quickstart
        • Architecture and Terminology
        • A Visual Example
        • Goals and Relationship to ZeekControl
        • Running Controller and Agent
        • Node Operation and Outputs
        • Log Management
        • The zeek-client CLI
        • Common cluster management tasks
      • NetControl Framework
        • NetControl Architecture
        • NetControl API
        • NetControl Plugins
      • Notice Framework
        • Overview
        • Processing Notices
        • Raising Notices
        • Automated Suppression
        • Extending Notice Framework
        • Cluster Considerations
        • The Weird Log
      • Packet Analysis
        • The Flow of Packets
        • Packet Analyzer Configuration
        • Packet Analyzer API
      • Signature Framework
        • Basics
        • Signature Language for Network Traffic
        • Signature Language for File Content
        • Things to keep in mind when writing signatures
        • Options
        • So, how about using Snort signatures with Zeek?
      • Storage Framework
        • Terminology
        • Asynchronous Mode vs Synchronous Mode
        • Using the Storage Framework
        • Events
        • Notes for Built-in Backends
      • Summary Statistics
        • Overview
        • Terminology
        • Examples
      • Supervisor Framework
        • Simple Example
        • Supervised Cluster Example
        • Internal Architecture
        • Node Revival
      • Telemetry Framework
        • Metric Types
        • Cluster Considerations
        • Metrics Export
        • Examples of Metrics Application
      • TLS Decryption
        • Capturing and decrypting a trace file
        • Decrypting live traffic
        • TLS Decryption API
    • Script Index
      • Log Files
        • Network Protocols
        • Files
        • NetControl
        • Detection
        • Network Observations
        • Miscellaneous
        • Zeek Diagnostics
      • Notices
      • Packet Analyzers
        • Zeek::ARP
        • Zeek::AYIYA
        • Zeek::Ethernet
        • Zeek::FDDI
        • Zeek::Geneve
        • Zeek::GRE
        • Zeek::GTPv1
        • Zeek::IEEE802_11
        • Zeek::IEEE802_11_Radio
        • Zeek::IGMP
        • Zeek::IP
        • Zeek::IPTunnel
        • Zeek::LinuxSLL
        • Zeek::LinuxSLL2
        • Zeek::LLC
        • Zeek::MPLS
        • Zeek::NFLog
        • Zeek::NOVELL_802_3
        • Zeek::Null
        • Zeek::PBB
        • Zeek::PPP
        • Zeek::PPPoE
        • Zeek::PPPSerial
        • Zeek::Root
        • Zeek::Skip
        • Zeek::SNAP
        • Zeek::Teredo
        • Zeek::VLAN
        • Zeek::VNTag
        • Zeek::VXLAN
      • Protocol Analyzers
        • Zeek::BitTorrent
        • Zeek::Cluster_WebSocket
        • Zeek::ConnSize
        • Zeek::DCE_RPC
        • Zeek::DHCP
        • Zeek::DNP3
        • Zeek::DNS
        • Zeek::File
        • Zeek::Finger
        • Zeek::FTP
        • Zeek::Gnutella
        • Zeek::GSSAPI
        • Zeek::HTTP
        • Zeek::Ident
        • Zeek::IMAP
        • Zeek::IRC
        • Zeek::JavaScript
        • Zeek::KRB
        • Zeek::LDAP
        • Zeek::Login
        • Zeek::MIME
        • Zeek::Modbus
        • Zeek::MQTT
        • Zeek::MySQL
        • Zeek::NCP
        • Zeek::NetBIOS
        • Zeek::NTLM
        • Zeek::NTP
        • Zeek::PIA
        • Zeek::POP3
        • Zeek::PostgreSQL
        • Zeek::QUIC
        • Zeek::RADIUS
        • Zeek::RDP
        • Zeek::Redis
        • Zeek::RFB
        • Zeek::RPC
        • Zeek::SIP
        • Zeek::SMB
        • Zeek::SMTP
        • Zeek::SNMP
        • Zeek::SOCKS
        • Zeek::SSH
        • Zeek::SSL
        • Zeek::StreamEvent
        • Zeek::Syslog
        • Zeek::TCP
        • Zeek::WebSocket
        • Zeek::XMPP
        • Zeek::ZIP
      • File Analyzers
        • Zeek::FileDataEvent
        • Zeek::FileEntropy
        • Zeek::FileExtract
        • Zeek::FileHash
        • Zeek::PE
        • Zeek::X509
      • Module Index
      • Complete Script Index
        • base/init-bare.zeek
        • base/bif/const.bif.zeek
        • base/bif/types.bif.zeek
        • base/bif/zeek.bif.zeek
        • base/bif/communityid.bif.zeek
        • base/bif/stats.bif.zeek
        • base/bif/reporter.bif.zeek
        • base/bif/strings.bif.zeek
        • base/bif/option.bif.zeek
        • base/frameworks/supervisor/api.zeek
        • base/bif/supervisor.bif.zeek
        • base/bif/packet_analysis.bif.zeek
        • base/bif/CPP-load.bif.zeek
        • base/bif/mmdb.bif.zeek
        • base/bif/plugins/Zeek_SNMP.types.bif.zeek
        • base/bif/plugins/Zeek_KRB.types.bif.zeek
        • base/bif/telemetry_functions.bif.zeek
        • base/bif/telemetry_types.bif.zeek
        • base/bif/event.bif.zeek
        • base/packet-protocols/__load__.zeek
        • base/packet-protocols/main.zeek
        • base/frameworks/analyzer/main.zeek
        • base/frameworks/packet-filter/utils.zeek
        • base/bif/analyzer.bif.zeek
        • base/bif/file_analysis.bif.zeek
        • base/packet-protocols/root/__load__.zeek
        • base/packet-protocols/root/main.zeek
        • base/packet-protocols/ip/__load__.zeek
        • base/packet-protocols/ip/main.zeek
        • base/packet-protocols/skip/__load__.zeek
        • base/packet-protocols/skip/main.zeek
        • base/packet-protocols/ethernet/__load__.zeek
        • base/packet-protocols/ethernet/main.zeek
        • base/packet-protocols/fddi/__load__.zeek
        • base/packet-protocols/fddi/main.zeek
        • base/packet-protocols/ieee802_11/__load__.zeek
        • base/packet-protocols/ieee802_11/main.zeek
        • base/packet-protocols/ieee802_11_radio/__load__.zeek
        • base/packet-protocols/ieee802_11_radio/main.zeek
        • base/packet-protocols/linux_sll/__load__.zeek
        • base/packet-protocols/linux_sll/main.zeek
        • base/packet-protocols/linux_sll2/__load__.zeek
        • base/packet-protocols/linux_sll2/main.zeek
        • base/packet-protocols/nflog/__load__.zeek
        • base/packet-protocols/nflog/main.zeek
        • base/packet-protocols/null/__load__.zeek
        • base/packet-protocols/null/main.zeek
        • base/packet-protocols/ppp/__load__.zeek
        • base/packet-protocols/ppp/main.zeek
        • base/packet-protocols/ppp_serial/__load__.zeek
        • base/packet-protocols/ppp_serial/main.zeek
        • base/packet-protocols/pppoe/__load__.zeek
        • base/packet-protocols/pppoe/main.zeek
        • base/packet-protocols/vlan/__load__.zeek
        • base/packet-protocols/vlan/main.zeek
        • base/packet-protocols/mpls/__load__.zeek
        • base/packet-protocols/mpls/main.zeek
        • base/packet-protocols/pbb/__load__.zeek
        • base/packet-protocols/pbb/main.zeek
        • base/packet-protocols/vntag/__load__.zeek
        • base/packet-protocols/vntag/main.zeek
        • base/packet-protocols/udp/__load__.zeek
        • base/packet-protocols/udp/main.zeek
        • base/packet-protocols/tcp/__load__.zeek
        • base/packet-protocols/tcp/main.zeek
        • base/packet-protocols/icmp/__load__.zeek
        • base/packet-protocols/icmp/main.zeek
        • base/packet-protocols/igmp/__load__.zeek
        • base/packet-protocols/igmp/types.zeek
        • base/packet-protocols/igmp/spicy-events.zeek
        • base/packet-protocols/igmp/main.zeek
        • base/packet-protocols/llc/__load__.zeek
        • base/packet-protocols/llc/main.zeek
        • base/packet-protocols/novell_802_3/__load__.zeek
        • base/packet-protocols/novell_802_3/main.zeek
        • base/packet-protocols/snap/__load__.zeek
        • base/packet-protocols/snap/main.zeek
        • base/packet-protocols/gre/__load__.zeek
        • base/packet-protocols/gre/main.zeek
        • base/packet-protocols/iptunnel/__load__.zeek
        • base/packet-protocols/iptunnel/main.zeek
        • base/packet-protocols/ayiya/__load__.zeek
        • base/packet-protocols/ayiya/main.zeek
        • base/packet-protocols/geneve/__load__.zeek
        • base/packet-protocols/geneve/main.zeek
        • base/packet-protocols/vxlan/__load__.zeek
        • base/packet-protocols/vxlan/main.zeek
        • base/packet-protocols/teredo/__load__.zeek
        • base/packet-protocols/teredo/main.zeek
        • base/bif/plugins/Zeek_Teredo.events.bif.zeek
        • base/bif/plugins/Zeek_Teredo.functions.bif.zeek
        • base/protocols/conn/removal-hooks.zeek
        • base/packet-protocols/gtpv1/__load__.zeek
        • base/packet-protocols/gtpv1/main.zeek
        • base/bif/plugins/Zeek_GTPv1.events.bif.zeek
        • base/bif/plugins/Zeek_GTPv1.functions.bif.zeek
        • base/frameworks/spicy/init-bare.zeek
        • builtin-plugins/__preload__.zeek
        • base/init-frameworks-and-bifs.zeek
        • base/frameworks/logging/__load__.zeek
        • base/frameworks/logging/main.zeek
        • base/bif/logging.bif.zeek
        • base/frameworks/logging/postprocessors/__load__.zeek
        • base/frameworks/logging/postprocessors/scp.zeek
        • base/frameworks/logging/postprocessors/sftp.zeek
        • base/frameworks/logging/writers/ascii.zeek
        • base/frameworks/logging/writers/sqlite.zeek
        • base/frameworks/logging/writers/none.zeek
        • base/frameworks/broker/__load__.zeek
        • base/frameworks/broker/main.zeek
        • base/bif/comm.bif.zeek
        • base/bif/messaging.bif.zeek
        • base/frameworks/broker/store.zeek
        • base/bif/data.bif.zeek
        • base/bif/store.bif.zeek
        • base/frameworks/broker/log.zeek
        • base/frameworks/broker/backpressure.zeek
        • base/frameworks/supervisor/__load__.zeek
        • base/frameworks/supervisor/control.zeek
        • base/frameworks/supervisor/main.zeek
        • base/frameworks/cluster/pubsub.zeek
        • base/frameworks/cluster/types.zeek
        • base/bif/cluster.bif.zeek
        • base/frameworks/input/__load__.zeek
        • base/frameworks/input/main.zeek
        • base/bif/input.bif.zeek
        • base/frameworks/input/readers/ascii.zeek
        • base/frameworks/input/readers/raw.zeek
        • base/frameworks/input/readers/benchmark.zeek
        • base/frameworks/input/readers/binary.zeek
        • base/frameworks/input/readers/config.zeek
        • base/frameworks/input/readers/sqlite.zeek
        • base/frameworks/cluster/__load__.zeek
        • base/frameworks/cluster/main.zeek
        • base/frameworks/control/__load__.zeek
        • base/frameworks/control/main.zeek
        • base/bif/plugins/Zeek_Cluster_WebSocket.events.bif.zeek
        • base/frameworks/cluster/pools.zeek
        • base/utils/hash_hrw.zeek
        • base/frameworks/cluster/publish-on-change.zeek
        • base/bif/publish_on_change.bif.zeek
        • base/frameworks/cluster/telemetry.zeek
        • base/frameworks/config/__load__.zeek
        • base/frameworks/config/main.zeek
        • base/frameworks/config/input.zeek
        • base/frameworks/config/weird.zeek
        • base/frameworks/analyzer/__load__.zeek
        • base/frameworks/analyzer/dpd.zeek
        • base/frameworks/analyzer/logging.zeek
        • base/frameworks/files/__load__.zeek
        • base/frameworks/files/main.zeek
        • base/utils/site.zeek
        • base/utils/patterns.zeek
        • base/frameworks/files/magic/__load__.zeek
        • base/frameworks/telemetry/options.zeek
        • base/bif/__load__.zeek
        • base/bif/telemetry_consts.bif.zeek
        • base/bif/zeekygen.bif.zeek
        • base/bif/pcap.bif.zeek
        • base/bif/bloom-filter.bif.zeek
        • base/bif/cardinality-counter.bif.zeek
        • base/bif/top-k.bif.zeek
        • base/bif/zam-prof.bif.zeek
        • base/bif/storage.bif.zeek
        • base/bif/storage-async.bif.zeek
        • base/bif/storage-events.bif.zeek
        • base/bif/storage-sync.bif.zeek
        • base/bif/spicy.bif.zeek
        • base/bif/plugins/__load__.zeek
        • base/bif/plugins/Zeek_BitTorrent.events.bif.zeek
        • base/bif/plugins/Zeek_ConnSize.events.bif.zeek
        • base/bif/plugins/Zeek_ConnSize.functions.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.consts.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.types.bif.zeek
        • base/bif/plugins/Zeek_DCE_RPC.events.bif.zeek
        • base/bif/plugins/Zeek_DHCP.events.bif.zeek
        • base/bif/plugins/Zeek_DHCP.types.bif.zeek
        • base/bif/plugins/Zeek_DNP3.events.bif.zeek
        • base/bif/plugins/Zeek_DNS.events.bif.zeek
        • base/bif/plugins/Zeek_File.events.bif.zeek
        • base/bif/plugins/Zeek_FTP.events.bif.zeek
        • base/bif/plugins/Zeek_FTP.functions.bif.zeek
        • base/bif/plugins/Zeek_Gnutella.events.bif.zeek
        • base/bif/plugins/Zeek_GSSAPI.events.bif.zeek
        • base/bif/plugins/Zeek_HTTP.events.bif.zeek
        • base/bif/plugins/Zeek_HTTP.functions.bif.zeek
        • base/bif/plugins/Zeek_Ident.events.bif.zeek
        • base/bif/plugins/Zeek_IMAP.events.bif.zeek
        • base/bif/plugins/Zeek_IRC.events.bif.zeek
        • base/bif/plugins/Zeek_KRB.events.bif.zeek
        • base/bif/plugins/Zeek_Login.events.bif.zeek
        • base/bif/plugins/Zeek_Login.functions.bif.zeek
        • base/bif/plugins/Zeek_MIME.consts.bif.zeek
        • base/bif/plugins/Zeek_MIME.events.bif.zeek
        • base/bif/plugins/Zeek_Modbus.events.bif.zeek
        • base/bif/plugins/Zeek_MQTT.types.bif.zeek
        • base/bif/plugins/Zeek_MQTT.events.bif.zeek
        • base/bif/plugins/Zeek_MySQL.events.bif.zeek
        • base/bif/plugins/Zeek_NCP.events.bif.zeek
        • base/bif/plugins/Zeek_NCP.consts.bif.zeek
        • base/bif/plugins/Zeek_NetBIOS.events.bif.zeek
        • base/bif/plugins/Zeek_NetBIOS.functions.bif.zeek
        • base/bif/plugins/Zeek_NTLM.types.bif.zeek
        • base/bif/plugins/Zeek_NTLM.events.bif.zeek
        • base/bif/plugins/Zeek_NTP.types.bif.zeek
        • base/bif/plugins/Zeek_NTP.events.bif.zeek
        • base/bif/plugins/Zeek_POP3.consts.bif.zeek
        • base/bif/plugins/Zeek_POP3.events.bif.zeek
        • base/bif/plugins/Zeek_RADIUS.events.bif.zeek
        • base/bif/plugins/Zeek_RDP.events.bif.zeek
        • base/bif/plugins/Zeek_RDP.types.bif.zeek
        • base/bif/plugins/Zeek_RFB.events.bif.zeek
        • base/bif/plugins/Zeek_RPC.events.bif.zeek
        • base/bif/plugins/Zeek_SIP.events.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_check_directory.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_close.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_create_directory.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_echo.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_logoff_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_negotiate.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_nt_create_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_nt_cancel.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_query_information.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_read_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_session_setup_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction_secondary.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction2.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_transaction2_secondary.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_tree_connect_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_tree_disconnect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_com_write_andx.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb1_events.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_close.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_create.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_negotiate.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_read.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_session_setup.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_set_info.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_tree_connect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_tree_disconnect.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_write.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_com_transform_header.bif.zeek
        • base/bif/plugins/Zeek_SMB.smb2_events.bif.zeek
        • base/bif/plugins/Zeek_SMB.events.bif.zeek
        • base/bif/plugins/Zeek_SMB.consts.bif.zeek
        • base/bif/plugins/Zeek_SMB.types.bif.zeek
        • base/bif/plugins/Zeek_SMTP.consts.bif.zeek
        • base/bif/plugins/Zeek_SMTP.events.bif.zeek
        • base/bif/plugins/Zeek_SMTP.functions.bif.zeek
        • base/bif/plugins/Zeek_SNMP.events.bif.zeek
        • base/bif/plugins/Zeek_SOCKS.events.bif.zeek
        • base/bif/plugins/Zeek_SSH.types.bif.zeek
        • base/bif/plugins/Zeek_SSH.events.bif.zeek
        • base/bif/plugins/Zeek_SSL.types.bif.zeek
        • base/bif/plugins/Zeek_SSL.events.bif.zeek
        • base/bif/plugins/Zeek_SSL.functions.bif.zeek
        • base/bif/plugins/Zeek_SSL.consts.bif.zeek
        • base/bif/plugins/Zeek_StreamEvent.events.bif.zeek
        • base/bif/plugins/Zeek_TCP.events.bif.zeek
        • base/bif/plugins/Zeek_TCP.types.bif.zeek
        • base/bif/plugins/Zeek_TCP.functions.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.consts.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.events.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.functions.bif.zeek
        • base/bif/plugins/Zeek_WebSocket.types.bif.zeek
        • base/bif/plugins/Zeek_XMPP.events.bif.zeek
        • base/bif/plugins/Zeek_Cluster_Backend_ZeroMQ.cluster_backend_zeromq.bif.zeek
        • base/bif/plugins/Zeek_PPPoE.functions.bif.zeek
        • base/bif/plugins/Zeek_ARP.events.bif.zeek
        • base/bif/plugins/Zeek_UDP.events.bif.zeek
        • base/bif/plugins/Zeek_ICMP.events.bif.zeek
        • base/bif/plugins/Zeek_Geneve.events.bif.zeek
        • base/bif/plugins/Zeek_Geneve.functions.bif.zeek
        • base/bif/plugins/Zeek_VXLAN.events.bif.zeek
        • base/bif/plugins/Zeek_FileEntropy.events.bif.zeek
        • base/bif/plugins/Zeek_FileExtract.events.bif.zeek
        • base/bif/plugins/Zeek_FileExtract.functions.bif.zeek
        • base/bif/plugins/Zeek_FileHash.events.bif.zeek
        • base/bif/plugins/Zeek_PE.events.bif.zeek
        • base/bif/plugins/Zeek_X509.events.bif.zeek
        • base/bif/plugins/Zeek_X509.types.bif.zeek
        • base/bif/plugins/Zeek_X509.functions.bif.zeek
        • base/bif/plugins/Zeek_X509.ocsp_events.bif.zeek
        • base/bif/plugins/Zeek_AsciiReader.ascii.bif.zeek
        • base/bif/plugins/Zeek_BenchmarkReader.benchmark.bif.zeek
        • base/bif/plugins/Zeek_BinaryReader.binary.bif.zeek
        • base/bif/plugins/Zeek_ConfigReader.config.bif.zeek
        • base/bif/plugins/Zeek_RawReader.raw.bif.zeek
        • base/bif/plugins/Zeek_SQLiteReader.sqlite.bif.zeek
        • base/bif/plugins/Zeek_AF_Packet.af_packet.bif.zeek
        • base/bif/plugins/Zeek_AsciiWriter.ascii.bif.zeek
        • base/bif/plugins/Zeek_NoneWriter.none.bif.zeek
        • base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
        • base/bif/plugins/Zeek_JavaScript.zeekjs.bif.zeek
        • base/bif/plugins/Zeek_PacketSourceUDP.packet_source_udp.bif.zeek
        • base/frameworks/spicy/init-framework.zeek
        • base/init-default.zeek
        • base/utils/active-http.zeek
        • base/utils/exec.zeek
        • base/utils/addrs.zeek
        • base/utils/backtrace.zeek
        • base/utils/conn-ids.zeek
        • base/utils/dir.zeek
        • base/frameworks/reporter/__load__.zeek
        • base/frameworks/reporter/main.zeek
        • base/utils/paths.zeek
        • base/utils/directions-and-hosts.zeek
        • base/utils/email.zeek
        • base/utils/files.zeek
        • base/utils/geoip-distance.zeek
        • base/utils/numbers.zeek
        • base/utils/packages.zeek
        • base/utils/queue.zeek
        • base/utils/strings.zeek
        • base/utils/thresholds.zeek
        • base/utils/time.zeek
        • base/utils/urls.zeek
        • base/frameworks/notice/__load__.zeek
        • base/frameworks/notice/main.zeek
        • base/frameworks/notice/weird.zeek
        • base/frameworks/notice/actions/email_admin.zeek
        • base/frameworks/notice/actions/page.zeek
        • base/frameworks/notice/actions/add-geodata.zeek
        • base/frameworks/notice/actions/pp-alarms.zeek
        • base/frameworks/signatures/__load__.zeek
        • base/frameworks/signatures/main.zeek
        • base/frameworks/packet-filter/__load__.zeek
        • base/frameworks/packet-filter/main.zeek
        • base/frameworks/packet-filter/netstats.zeek
        • base/frameworks/software/__load__.zeek
        • base/frameworks/software/main.zeek
        • base/frameworks/intel/__load__.zeek
        • base/frameworks/intel/main.zeek
        • base/frameworks/intel/files.zeek
        • base/frameworks/intel/input.zeek
        • base/frameworks/sumstats/__load__.zeek
        • base/frameworks/sumstats/main.zeek
        • base/frameworks/sumstats/plugins/__load__.zeek
        • base/frameworks/sumstats/plugins/average.zeek
        • base/frameworks/sumstats/plugins/hll_unique.zeek
        • base/frameworks/sumstats/plugins/last.zeek
        • base/frameworks/sumstats/plugins/max.zeek
        • base/frameworks/sumstats/plugins/min.zeek
        • base/frameworks/sumstats/plugins/sample.zeek
        • base/frameworks/sumstats/plugins/std-dev.zeek
        • base/frameworks/sumstats/plugins/variance.zeek
        • base/frameworks/sumstats/plugins/sum.zeek
        • base/frameworks/sumstats/plugins/topk.zeek
        • base/frameworks/sumstats/plugins/unique.zeek
        • base/frameworks/sumstats/non-cluster.zeek
        • base/frameworks/tunnels/__load__.zeek
        • base/frameworks/tunnels/main.zeek
        • base/frameworks/openflow/__load__.zeek
        • base/frameworks/openflow/consts.zeek
        • base/frameworks/openflow/types.zeek
        • base/frameworks/openflow/main.zeek
        • base/frameworks/openflow/plugins/__load__.zeek
        • base/frameworks/openflow/plugins/ryu.zeek
        • base/frameworks/openflow/plugins/log.zeek
        • base/frameworks/openflow/plugins/broker.zeek
        • base/frameworks/openflow/non-cluster.zeek
        • base/frameworks/netcontrol/__load__.zeek
        • base/frameworks/netcontrol/types.zeek
        • base/frameworks/netcontrol/main.zeek
        • base/frameworks/netcontrol/plugin.zeek
        • base/frameworks/netcontrol/plugins/__load__.zeek
        • base/frameworks/netcontrol/plugins/debug.zeek
        • base/frameworks/netcontrol/plugins/openflow.zeek
        • base/frameworks/netcontrol/plugins/packetfilter.zeek
        • base/frameworks/netcontrol/plugins/broker.zeek
        • base/frameworks/netcontrol/plugins/acld.zeek
        • base/frameworks/netcontrol/drop.zeek
        • base/frameworks/netcontrol/shunt.zeek
        • base/frameworks/netcontrol/non-cluster.zeek
        • base/frameworks/telemetry/__load__.zeek
        • base/frameworks/telemetry/main.zeek
        • base/misc/version.zeek
        • base/frameworks/storage/__load__.zeek
        • base/frameworks/storage/async.zeek
        • base/frameworks/storage/main.zeek
        • base/frameworks/storage/sync.zeek
        • base/frameworks/spicy/__load__.zeek
        • base/frameworks/spicy/main.zeek
        • base/protocols/conn/__load__.zeek
        • base/protocols/conn/main.zeek
        • base/protocols/conn/contents.zeek
        • base/protocols/conn/inactivity.zeek
        • base/protocols/conn/polling.zeek
        • base/protocols/conn/thresholds.zeek
        • base/protocols/dce-rpc/__load__.zeek
        • base/protocols/dce-rpc/consts.zeek
        • base/protocols/dce-rpc/main.zeek
        • base/protocols/dhcp/__load__.zeek
        • base/protocols/dhcp/consts.zeek
        • base/protocols/dhcp/main.zeek
        • base/protocols/dnp3/__load__.zeek
        • base/protocols/dnp3/main.zeek
        • base/protocols/dnp3/consts.zeek
        • base/protocols/dns/__load__.zeek
        • base/protocols/dns/consts.zeek
        • base/protocols/dns/main.zeek
        • base/protocols/dns/check-event-handlers.zeek
        • base/protocols/finger/__load__.zeek
        • base/protocols/finger/spicy-events.zeek
        • base/protocols/finger/main.zeek
        • base/protocols/ftp/__load__.zeek
        • base/protocols/ftp/utils-commands.zeek
        • base/protocols/ftp/info.zeek
        • base/protocols/ftp/main.zeek
        • base/protocols/ftp/utils.zeek
        • base/protocols/ftp/files.zeek
        • base/protocols/ftp/gridftp.zeek
        • base/protocols/ssl/__load__.zeek
        • base/protocols/ssl/consts.zeek
        • base/protocols/ssl/main.zeek
        • base/protocols/ssl/mozilla-ca-list.zeek
        • base/protocols/ssl/ct-list.zeek
        • base/protocols/ssl/files.zeek
        • base/files/x509/__load__.zeek
        • base/files/x509/main.zeek
        • base/files/hash/__load__.zeek
        • base/files/hash/main.zeek
        • base/files/x509/certificate-event-cache.zeek
        • base/files/x509/log-ocsp.zeek
        • base/protocols/http/__load__.zeek
        • base/protocols/http/main.zeek
        • base/protocols/http/entities.zeek
        • base/protocols/http/utils.zeek
        • base/protocols/http/files.zeek
        • base/protocols/imap/__load__.zeek
        • base/protocols/imap/main.zeek
        • base/protocols/irc/__load__.zeek
        • base/protocols/irc/main.zeek
        • base/protocols/irc/dcc-send.zeek
        • base/protocols/irc/files.zeek
        • base/protocols/krb/__load__.zeek
        • base/protocols/krb/main.zeek
        • base/protocols/krb/consts.zeek
        • base/protocols/krb/files.zeek
        • base/protocols/ldap/__load__.zeek
        • base/protocols/ldap/spicy-events.zeek
        • base/protocols/ldap/consts.zeek
        • base/protocols/ldap/main.zeek
        • base/protocols/modbus/__load__.zeek
        • base/protocols/modbus/consts.zeek
        • base/protocols/modbus/main.zeek
        • base/protocols/mqtt/__load__.zeek
        • base/protocols/mqtt/consts.zeek
        • base/protocols/mqtt/main.zeek
        • base/protocols/mysql/__load__.zeek
        • base/protocols/mysql/main.zeek
        • base/protocols/mysql/consts.zeek
        • base/protocols/ntlm/__load__.zeek
        • base/protocols/ntlm/main.zeek
        • base/protocols/ntp/__load__.zeek
        • base/protocols/ntp/main.zeek
        • base/protocols/ntp/consts.zeek
        • base/protocols/pop3/__load__.zeek
        • base/protocols/postgresql/__load__.zeek
        • base/protocols/postgresql/consts.zeek
        • base/protocols/postgresql/spicy-events.zeek
        • base/protocols/postgresql/main.zeek
        • base/protocols/quic/__load__.zeek
        • base/protocols/quic/spicy-events.zeek
        • base/protocols/quic/consts.zeek
        • base/protocols/quic/main.zeek
        • base/protocols/radius/__load__.zeek
        • base/protocols/radius/main.zeek
        • base/protocols/radius/consts.zeek
        • base/protocols/rdp/__load__.zeek
        • base/protocols/rdp/consts.zeek
        • base/protocols/rdp/main.zeek
        • base/protocols/redis/__load__.zeek
        • base/protocols/redis/spicy-events.zeek
        • base/protocols/redis/main.zeek
        • base/protocols/rfb/__load__.zeek
        • base/protocols/rfb/main.zeek
        • base/protocols/sip/__load__.zeek
        • base/protocols/sip/main.zeek
        • base/protocols/snmp/__load__.zeek
        • base/protocols/snmp/main.zeek
        • base/protocols/smb/__load__.zeek
        • base/protocols/smb/consts.zeek
        • base/protocols/smb/const-dos-error.zeek
        • base/protocols/smb/const-nt-status.zeek
        • base/protocols/smb/main.zeek
        • base/protocols/smb/smb1-main.zeek
        • base/protocols/smb/smb2-main.zeek
        • base/protocols/smb/files.zeek
        • base/protocols/smtp/__load__.zeek
        • base/protocols/smtp/main.zeek
        • base/protocols/smtp/entities.zeek
        • base/protocols/smtp/files.zeek
        • base/protocols/socks/__load__.zeek
        • base/protocols/socks/consts.zeek
        • base/protocols/socks/main.zeek
        • base/protocols/ssh/__load__.zeek
        • base/protocols/ssh/main.zeek
        • base/protocols/syslog/__load__.zeek
        • base/protocols/syslog/spicy-events.zeek
        • base/protocols/syslog/consts.zeek
        • base/protocols/syslog/main.zeek
        • base/protocols/websocket/__load__.zeek
        • base/protocols/websocket/consts.zeek
        • base/protocols/websocket/main.zeek
        • base/protocols/tunnels/__load__.zeek
        • base/protocols/xmpp/__load__.zeek
        • base/protocols/xmpp/main.zeek
        • base/files/pe/__load__.zeek
        • base/files/pe/consts.zeek
        • base/files/pe/main.zeek
        • base/files/extract/__load__.zeek
        • base/files/extract/main.zeek
        • base/files/zip/__load__.zeek
        • base/files/zip/main.zeek
        • base/files/zip/types.zeek
        • base/misc/find-checksum-offloading.zeek
        • base/misc/find-filtered-trace.zeek
        • base/misc/installation.zeek
        • builtin-plugins/__load__.zeek
        • builtin-plugins/Zeek_JavaScript/__load__.zeek
        • builtin-plugins/Zeek_PacketSourceUDP/__load__.zeek
        • zeekygen/__load__.zeek
        • test-all-policy.zeek
        • policy/frameworks/analyzer/debug-logging.zeek
        • policy/frameworks/analyzer/detect-protocols.zeek
        • policy/frameworks/analyzer/packet-segment-logging.zeek
        • policy/frameworks/cluster/backend/broker/__load__.zeek
        • policy/frameworks/cluster/backend/broker/main.zeek
        • policy/frameworks/cluster/backend/broker/backpressure.zeek
        • policy/frameworks/cluster/backend/broker/telemetry.zeek
        • policy/frameworks/cluster/backend/zeromq/__load__.zeek
        • policy/frameworks/cluster/backend/zeromq/options.zeek
        • policy/frameworks/cluster/backend/zeromq/main.zeek
        • policy/frameworks/cluster/backend/zeromq/connect.zeek
        • policy/frameworks/cluster/experimental.zeek
        • policy/frameworks/management/agent/__load__.zeek
        • policy/frameworks/management/agent/api.zeek
        • policy/frameworks/management/types.zeek
        • policy/frameworks/management/agent/boot.zeek
        • policy/frameworks/management/agent/config.zeek
        • policy/frameworks/management/__load__.zeek
        • policy/frameworks/management/config.zeek
        • policy/frameworks/management/log.zeek
        • policy/frameworks/management/persistence.zeek
        • policy/frameworks/management/request.zeek
        • policy/frameworks/management/util.zeek
        • policy/frameworks/management/controller/config.zeek
        • policy/frameworks/management/controller/__load__.zeek
        • policy/frameworks/management/controller/api.zeek
        • policy/frameworks/management/controller/boot.zeek
        • policy/frameworks/management/node/api.zeek
        • policy/frameworks/management/node/config.zeek
        • policy/frameworks/management/supervisor/__load__.zeek
        • policy/frameworks/management/supervisor/main.zeek
        • policy/frameworks/management/supervisor/api.zeek
        • policy/frameworks/management/supervisor/config.zeek
        • policy/frameworks/intel/do_notice.zeek
        • policy/frameworks/intel/do_expire.zeek
        • policy/frameworks/intel/whitelist.zeek
        • policy/frameworks/intel/removal.zeek
        • policy/frameworks/intel/seen/__load__.zeek
        • policy/frameworks/intel/seen/conn-established.zeek
        • policy/frameworks/intel/seen/where-locations.zeek
        • policy/frameworks/intel/seen/dns.zeek
        • policy/frameworks/intel/seen/file-hashes.zeek
        • policy/frameworks/intel/seen/file-names.zeek
        • policy/frameworks/intel/seen/http-headers.zeek
        • policy/frameworks/intel/seen/http-url.zeek
        • policy/frameworks/intel/seen/pubkey-hashes.zeek
        • policy/frameworks/intel/seen/ssl.zeek
        • policy/frameworks/intel/seen/smb-filenames.zeek
        • policy/frameworks/intel/seen/smtp.zeek
        • policy/frameworks/intel/seen/smtp-url-extraction.zeek
        • policy/frameworks/intel/seen/x509.zeek
        • policy/frameworks/intel/seen/manage-event-groups.zeek
        • policy/frameworks/netcontrol/catch-and-release.zeek
        • policy/frameworks/files/detect-MHR.zeek
        • policy/frameworks/files/hash-all-files.zeek
        • policy/frameworks/files/entropy-test-all-files.zeek
        • policy/frameworks/notice/__load__.zeek
        • policy/frameworks/notice/extend-email/hostnames.zeek
        • policy/frameworks/notice/actions/drop.zeek
        • policy/frameworks/notice/community-id.zeek
        • policy/protocols/conn/community-id-logging.zeek
        • policy/files/x509/disable-certificate-events-known-certs.zeek
        • policy/files/zip/register.zeek
        • policy/frameworks/packet-filter/shunt.zeek
        • policy/frameworks/software/version-changes.zeek
        • policy/frameworks/software/vulnerable.zeek
        • policy/frameworks/software/windows-version-detection.zeek
        • policy/frameworks/storage/backend/redis/__load__.zeek
        • policy/frameworks/storage/backend/redis/main.zeek
        • policy/frameworks/storage/backend/sqlite/__load__.zeek
        • policy/frameworks/storage/backend/sqlite/main.zeek
        • policy/frameworks/telemetry/log.zeek
        • policy/integration/collective-intel/__load__.zeek
        • policy/integration/collective-intel/main.zeek
        • policy/misc/capture-loss.zeek
        • policy/misc/detect-traceroute/__load__.zeek
        • policy/misc/detect-traceroute/main.zeek
        • policy/misc/loaded-scripts.zeek
        • policy/misc/profiling.zeek
        • policy/misc/stats.zeek
        • policy/misc/weird-stats.zeek
        • policy/misc/trim-trace-file.zeek
        • policy/misc/unknown-protocols.zeek
        • policy/protocols/conn/disable-unknown-ip-proto-support.zeek
        • policy/protocols/conn/failed-service-logging.zeek
        • policy/protocols/conn/ip-proto-name-logging.zeek
        • policy/protocols/conn/known-hosts.zeek
        • policy/protocols/conn/known-services.zeek
        • policy/protocols/conn/mac-logging.zeek
        • policy/protocols/conn/multicast-participants.zeek
        • policy/protocols/conn/vlan-logging.zeek
        • policy/protocols/conn/pppoe-session-id-logging.zeek
        • policy/protocols/conn/weirds.zeek
        • policy/protocols/dhcp/msg-orig.zeek
        • policy/protocols/dhcp/software.zeek
        • policy/protocols/dhcp/sub-opts.zeek
        • policy/protocols/dns/auth-addl.zeek
        • policy/protocols/dns/detect-external-names.zeek
        • policy/protocols/dns/log-original-query-case.zeek
        • policy/protocols/ftp/detect-bruteforcing.zeek
        • policy/protocols/ftp/detect.zeek
        • policy/protocols/ftp/software.zeek
        • policy/protocols/http/detect-sql-injection.zeek
        • policy/protocols/http/detect-webapps.zeek
        • policy/protocols/http/header-names.zeek
        • policy/protocols/http/software-browser-plugins.zeek
        • policy/protocols/http/software.zeek
        • policy/protocols/http/var-extraction-cookies.zeek
        • policy/protocols/http/var-extraction-uri.zeek
        • policy/protocols/krb/ticket-logging.zeek
        • policy/protocols/krb/md5-ticket-logging.zeek
        • policy/protocols/modbus/known-masters-slaves.zeek
        • policy/protocols/modbus/track-memmap.zeek
        • policy/protocols/mysql/software.zeek
        • policy/protocols/rdp/indicate_ssl.zeek
        • policy/protocols/smb/log-cmds.zeek
        • policy/protocols/smtp/blocklists.zeek
        • policy/protocols/smtp/detect-suspicious-orig.zeek
        • policy/protocols/smtp/entities-excerpt.zeek
        • policy/protocols/smtp/software.zeek
        • policy/protocols/ssh/detect-bruteforcing.zeek
        • policy/protocols/ssh/geo-data.zeek
        • policy/protocols/ssh/interesting-hostnames.zeek
        • policy/protocols/ssh/md5-host-key-logging.zeek
        • policy/protocols/ssh/software.zeek
        • policy/protocols/ssl/certificate-request-info.zeek
        • policy/protocols/ssl/decryption.zeek
        • policy/protocols/ssl/expiring-certs.zeek
        • policy/protocols/ssl/heartbleed.zeek
        • policy/protocols/ssl/known-certs.zeek
        • policy/protocols/ssl/log-certs-base64.zeek
        • policy/protocols/ssl/ssl-log-ext.zeek
        • policy/protocols/ssl/log-hostcerts-only.zeek
        • policy/protocols/ssl/validate-certs.zeek
        • policy/protocols/ssl/validate-ocsp.zeek
        • policy/protocols/ssl/validate-sct.zeek
        • policy/protocols/ssl/weak-keys.zeek
        • policy/tuning/json-logs.zeek
        • policy/tuning/track-all-assets.zeek
        • policy/frameworks/conn_key/vlan_fivetuple.zeek
        • policy/frameworks/cluster/nodes-experimental/manager.zeek
        • policy/frameworks/cluster/websocket/server.zeek
        • policy/frameworks/control/controllee.zeek
        • policy/frameworks/control/controller.zeek
        • policy/frameworks/management/agent/main.zeek
        • policy/frameworks/management/controller/main.zeek
        • policy/frameworks/management/node/__load__.zeek
        • policy/frameworks/management/node/main.zeek
        • policy/frameworks/files/extract-all-files.zeek
        • policy/frameworks/signatures/iso-9660.zeek
        • policy/misc/dump-events.zeek
        • policy/misc/systemd-generator.zeek
        • base/frameworks/cluster/nodes/logger.zeek
        • policy/protocols/conn/speculative-service.zeek
        • policy/protocols/dns/disable-opcode-log-fields.zeek
        • policy/frameworks/spicy/resource-usage.zeek
        • zeekygen/example.zeek
  • Popular Customizations
    • Log Enrichment
      • Community ID
      • Address geolocation and AS lookups
        • Building Zeek with libmaxminddb
        • Installing and configuring GeoIP databases
        • Querying the databases
        • Testing
        • Example
    • Log Writers
      • Kafka
    • Logging
      • JSON Streaming Logs
      • Long Connections
    • Profiling and Debugging
      • jemalloc profiling
  • Advanced Topics
    • Troubleshooting
      • Memory Leaks and State Growth
        • Jemalloc Memory Profiling
      • CPU Profiling
        • Perf and Flame Graphs
      • Metrics and Stats
        • Telemetry Framework and Prometheus
        • stats.log
        • prof.log
    • Scripting
      • Use of conn_id_ctx
      • Script Optimization
        • Introduction
        • Other Optimization Features
      • Finding Potential Usage Errors
    • Developer Guides
      • Writing Plugins
        • Quick Start
        • Plugin Directory Layout
        • init-plugin
        • Activating a Plugin
        • Plugin Components
        • Testing Plugins
        • Debugging Plugins
        • Building Plugins Statically into Zeek
        • Plugin Tutorials
      • Writing Analyzers with Spicy
        • Installation
        • Getting Started
        • Tutorial
        • Reference
        • FAQ
        • Terminology
      • Interacting with Zeek using WebSockets
        • Introduction
        • Background and Setup
        • Version 1
        • Outgoing Connections
      • Contributor’s Guide
        • General Contribution Process
        • Coding Style and Conventions
        • General Documentation Structure/Process
        • Documentation Style and Conventions
        • Checking for Memory Errors and Leaks
        • Maintaining long-lived forks of Zeek
      • Maintainer’s Guide
        • Release Process
      • Cluster Architectures
        • Introduction
        • Single Node Examples
        • Multi Node Examples
        • WebSocket API to the Publish/Subscribe Layer
        • Operational Metrics via Prometheus
      • Spawning a Cluster
        • Introduction
        • Cluster Layout
        • Spawning Processes
        • Minimal Shell-Based Supervisor
      • ZeroMQ Cluster Backend
        • Quickstart
        • Architecture
        • Encryption
      • Connection Handling
        • Checksum Behavior
        • Flipping Connections
    • Subcomponents
  • Acknowledgements
Index
Zeek
  • Zeek Reference
  • Script Index
  • Complete Script Index
  • zeekygen/__load__.zeek
  • View page source

zeekygen/__load__.zeek

Imports:

policy/frameworks/cluster/backend/zeromq/connect.zeek, policy/frameworks/cluster/nodes-experimental/manager.zeek, policy/frameworks/cluster/websocket/server.zeek, policy/frameworks/conn_key/vlan_fivetuple.zeek, policy/frameworks/control/controllee.zeek, policy/frameworks/control/controller.zeek, policy/frameworks/files/extract-all-files.zeek, policy/frameworks/management/agent/main.zeek, policy/frameworks/management/controller/main.zeek, policy/frameworks/management/node/__load__.zeek, policy/frameworks/management/node/main.zeek, policy/frameworks/signatures/iso-9660.zeek, policy/frameworks/spicy/resource-usage.zeek, policy/misc/dump-events.zeek, policy/misc/systemd-generator.zeek, policy/protocols/conn/speculative-service.zeek, policy/protocols/dns/disable-opcode-log-fields.zeek, policy/protocols/ssl/decryption.zeek, test-all-policy.zeek, zeekygen/example.zeek

Summary

Detailed Interface

Previous Next

© Copyright by the Zeek Project. Last updated on May 21, 2026.

Built with Sphinx using a theme provided by Read the Docs.