The gold standard for network monitoring
Zeek transforms network traffic into compact, high-fidelity transaction logs, allowing defenders to understand activity, detect attacks, and respond to them. Zeek sits out-of-band, on-prem or in the cloud. It gathers metadata and extracted files, and formats everything for input into any SIEM or XDR. Zeek provides the evidence that is foundational to Corelight’s Open NDR Platform.

The best network monitor, upgraded
- Enterprise-grade sensors in every form factor
- Built-in integrations with IDS and Smart PCAP
- Fully supported by the Corelight team
- Monitoring at 100 Gbps+
- Constantly improved with research from Corelight Labs
See how Zeek works
EVIDENCE
Zeek
Zeek delivers the metadata and files that are essential components of Corelight evidence. It provides a complete, accessible view of every connection for analysis, investigation, and hunting. Learn about Zeek on Windows.
