Zeek

Zeek decodes and analyzes over 40 network protocols at the application layer, including DNS, HTTP, SSL/TLS, SSH, and industrial protocols like Modbus and DNP3. Unlike simple flow collectors, Zeek parses the full protocol state machine, extracting granular metadata such as HTTP user-agents, TLS certificate chains, and DNS query types. This deep inspection enables detection of protocol violations, command-and-control beacons, and data exfiltration attempts that would be invisible to NetFlow-based tools.

Zeek operates on a behavioral analysis paradigm rather than relying on static signature matching. By establishing a behavioral baseline of normal network activity, Zeek's scripting framework can identify deviations such as:

• Unusual outbound connection patterns
• Protocol mismatches on standard ports
• Unexpected SCADA function codes in OT environments
• Kerberos ticket anomalies This signatureless approach is critical for detecting zero-day threats and advanced persistent threats that evade traditional intrusion detection systems.

Zeek includes a powerful, event-driven scripting language that allows security analysts to define custom detection logic, data reduction rules, and integration workflows. Scripts react to network events like connection_established, http_request, or dns_query, enabling precise, context-aware analysis. This extensibility makes Zeek ideal for process-aware detection in industrial control systems, where analysts can write scripts that correlate network anomalies with the physical state of the industrial process.

Zeek generates structured, tab-separated log files for every network connection, capturing over 50 fields per connection including timestamps, duration, byte counts, and application-layer metadata. These logs are designed for ingestion into SIEMs and data lakes like Splunk, Elasticsearch, or Kafka. The rich metadata enables long-term threat hunting and forensic investigation, allowing analysts to retroactively search for indicators of compromise months after an incident.

Zeek operates as a passive monitoring sensor, analyzing a copy of network traffic obtained via a Network TAP or SPAN port. This architecture ensures zero impact on network latency and zero risk of dropping packets on production links—a critical requirement for Operational Technology (OT) environments where determinism is paramount. Zeek never sits inline and never modifies traffic, making it safe for even the most sensitive industrial control networks.

Zeek can identify and extract files transferred over protocols like HTTP, FTP, and SMB directly from network traffic. Extracted files are automatically hashed and can be forwarded to sandboxing systems or malware analysis pipelines. This capability enables detection of malicious payload delivery without requiring endpoint agents, providing visibility into initial access vectors and lateral movement within both IT and OT network segments.

A statistical model of normal network behavior that Zeek logs help establish. By analyzing weeks of Zeek's conn.log and protocol-specific logs, security teams build profiles of:

• Typical communication pairs (who talks to whom)
• Command frequency distributions
• Payload size patterns
• Temporal rhythms (shift changes, maintenance windows) Deviations from this baseline trigger anomaly alerts. The baseline must be periodically recalibrated to account for concept drift as the industrial process evolves. Zeek's rich metadata makes baseline construction far more precise than flow-based alternatives.

A complementary security control that permits only pre-authorized industrial protocol commands. Zeek enhances whitelisting by providing the deep protocol parsing needed to validate:

• Function codes (e.g., Modbus read holding registers vs. write single coil)
• Data ranges (e.g., setpoint values within safe operating limits)
• Sequence validity (e.g., commands that make sense given the current process state) While whitelisting enforces policy at the network level, Zeek provides the visibility and forensic evidence to continuously validate that the whitelist rules remain effective against evolving threats.