zeek / zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

https://www.zeek.org

zeek/zeek Issues

sessions for non-analyzed protocols should still be tracked with a conn entry
Updated a month ago20
DNS Dynamic Update: Produces weird and is not confirmed
Updated 3 months ago3
Mismatch between `|...|` operator and what's returned for `enum`s and `port`s
Updated 3 months ago1
Remove need for topology awareness with broker
Updated 3 months ago
Reintroduce .evt port/ports handling as Zeek event
Closed 3 months ago1
OOM reports with Zeek 7.0.0 due to LDAP_TCP
Closed 3 months ago1
add conn entries for all tunnels and differentiate from non-tunnel conns
Updated 3 months ago2
Invalid-read in function `parse_port(char const*)`
Updated 3 months ago
Undefined-behavior in function `parse_port(const char* line)`
Updated 3 months ago
Add ZAM testing to CI
Updated 3 months ago
How to populate IMEI value Type 20
Closed 3 months ago
Deprecate certificate-less TLS for broker
Updated 3 months ago9
Add EML feature to the SMTP analyzer
Updated 3 months ago
opensuse zeek repos don't install on Fedora-40 - key error
Closed 4 months ago2
Zeek support for analyzing HTTP/2 and GRPC messages
Closed 6 months ago1
zeek 6.2.1, [ZeekControl] > start : error in /opt/zeek/share/zeek/policy/frameworks/control/controllee.zeek, line 13: syntax error, at or near "module"
Closed 5 months ago2
DNS TKEY support
Closed 3 months ago
MySQL login failure with `caching_sha2_password` misidentified as successful
Closed 3 months ago
`core.script-args` btest fails sporadically
Closed 3 months ago6
Add fuzzer for spicy LDAP analyzer
Closed 3 months ago
C++20 Support - Ubuntu 20 binary packages?
Closed 6 months ago5
Add fuzzing for caplen and packet loss
Updated 4 months ago8
LDAP SPNEGO NTLM not parsed properly
Closed 4 months ago
"non-void function returning without a value" when returning from a `when`-block
Closed 4 months ago2
Segfault: Input-framework ( coredumps with 7.0.00-rc1 )
Closed 4 months ago1
Track uptime, and report it as well as PID in stats & telemetry
Updated 4 months ago4
7.0.0-rc1 cmake error
Closed 4 months ago23
Core dump on running script that modifies connection record in log_stream_policy
Updated 4 months ago8
6.2.1 worker crashes with 'std::bad_function_call'
Closed 4 months ago11
Attempting to configure on Windows using GCC fails
Closed 4 months ago
`--display-cmake` option from `configure` modifies build directory
Closed 4 months ago
`&default` on `table` in a `record` has strange behavior (errors and aborts)
Closed 4 months ago3
6.2.1 worker crashes with zeek::analyzer::http::HTTP_Entity::Deliver(int, const char*, bool): Assertion `! trailing_CRLF' failed.
Closed 5 months ago5
Coredump 6.2.0: obj.h:166 zeek::Ref (o=0x0)
Updated 5 months ago1
Display tags for Spicy analyzers
Updated 5 months ago2
Spicy: Using `replaces` with a mismatching transport-layer analyzer can lead to crashes
Updated 5 months ago
Trailing semicolon in script erroneously reports syntax error on the next script
Closed 5 months ago3
Memory corruption when running custom analyzer
Closed 5 months ago1
Analyzer disabled upon startup
Closed 5 months ago1
Feature Request: Add a bind_address option for telemetry
Closed 5 months ago
Nightly aarch64 binary builds broken on some platforms due to libprometheus-cpp-core
Closed 5 months ago
zeekctl check fails with frameworks/telemetry/prometheus loaded: fatal error: Failed to setup Prometheus endpoint
Closed 5 months ago1
Telemetry headers reference Prometheus headers which are not installed
Closed 6 months ago1
Documentation could be more copy/pastable
Updated 6 months ago
Incorrect service reported for Spicy analyzer replacing builtin one
Closed 6 months ago
Sets supporting += for adding individual elements
Updated 7 months ago1
Updates needed for software framework.
Updated 7 months ago
Additional `conn_id` fields don't make it to the files.log
Closed 7 months ago1
Binary builds broken on debian 11 and ubuntu 22.04.
Closed 7 months ago1
Building with --disable-spicy results in an error when running unit tests
Closed 7 months ago1