Seven years after the formation of the previous significant branch the release of the traffic analysis and network intrusion detection system , formerly distributed under the name Bro. This is the first major release after , which was done because the name Bro was associated with a marginal subculture rather than the intended hint by the authors about "Big Brother" from George Orwell's novel "1984." The system's code is written in C++ and under the BSD license.
Zeek is a traffic analysis platform primarily focused on tracking security-related events but not limited to this application. Modules are provided for analyzing and parsing various application layer network protocols, taking into account the state of connections and allowing for detailed logging (archiving) of network activity. A domain-specific language is offered for writing monitoring and anomaly detection scripts tailored to the specifics of particular infrastructures. The system is optimized for use in high-bandwidth networks. An API is provided for integration with third-party information systems and real-time data exchange.
In :
- The NTP protocol analyzer has been completely rewritten and a new analyzer for MQTT has been added. The capabilities of the analyzers for DNS, RDP, SMB, and TLS have been expanded. For DNS, parsing of SPF records has been implemented, and for DNSSEC — RRSIG, DNSKEY, DS, NSEC, and NSEC3, including related event extraction. The SMB analyzer has added support for SMB 3.x, and for TLS, support for TLS 1.3;
- Support for decapsulation of streams transmitted inside VXLAN tunnels has been implemented;
- Support for links of type NFLOG has been added;
- The ability to save extracted data in UTF8 encoding has been added to the log;
- Support for closures for anonymous functions has been added to the scripting language, a key-value format table iteration operator has been introduced ("for ( key, value in t )"), Python-style vector slicing has been implemented ("v[2:4]"), and a new paraglob structure has been proposed for fast matching of string patterns in large sets of binary data.
- All mentions of the name "bro" in file paths, settings, packages, scripts, namespaces, and functions have been replaced with "zeek" (support for old names is retained for backward compatibility). The bro-pkg package manager has been renamed to zkg.
Source: opennet.ru
