Zeek Manual

Note

There’s three primary versions of this manual that track latest releases and development:

• Current Feature Release: https://docs.zeek.org/en/current
• Long-Term Support Release: https://docs.zeek.org/en/lts
• Git master Branch: https://docs.zeek.org/en/master

Introduction

• Introduction
  • Overview
  • Features
  • History
  • Architecture
• Cluster Architecture
  • Architecture
  • Frontend Options
• Installation
  • Installing
  • Upgrading
  • Cross Compiling
• Quick Start Guide
  • Managing Zeek with ZeekControl
  • Zeek as a Command-Line Utility
• Cluster Configuration
  • Preparing to Setup a Cluster
  • Basic Cluster Configuration
  • PF_RING Cluster Configuration

Examples and Use Cases

• Examples and Use Cases
  • Logging
    • Working with Log Files
  • Monitoring HTTP Traffic
    • Introduction to the HTTP log
    • Detecting a Proxy Server
    • Inspecting Files
  • IDS
    • Detecting an FTP Brute-force Attack and Notifying
    • Other Attacks
  • MIME Type Statistics
    • MIME Statistics with Sumstats
  • Writing Scripts
    • Understanding Scripts
    • The Event Queue and Event Handlers
    • The Connection Record Data Type
    • Data Types and Data Structures
    • Custom Logging
    • Raising Notices

Reference

• Frameworks
  • Configuration Framework
  • File Analysis
  • GeoLocation
  • Input Framework
  • Intelligence Framework
  • Logging Framework
  • NetControl Framework
  • Notice Framework
  • Signature Framework
  • Summary Statistics
  • Broker-Enabled Communication/Cluster Framework
  • Supervisor Framework
• Script Reference
  • Operators
  • Types
  • Attributes
  • Declarations and Statements
  • Directives
  • Log Files
  • Notices
  • Protocol Analyzers
  • File Analyzers
  • Zeek Package Index
  • Zeek Script Index
  • Zeekygen Example Script

Development

• Developer Guides
  • Writing Plugins
  • Contributor’s Guide
  • Maintainer’s Guide

Related Tools/Software

• Subcomponents

General Index