We are happy to announce the new "Zeek Agent", an open source endpoint
agent that turns host activity into Zeek events as it happens:
https://zeek.org/2020/03/23/announcing-the-zeek-agent
The agent currently supports Linux and macOS, with Windows being in
the works; and it integrates with osquery so that Zeek gains access to
all of the osquery tables.
This remains an early version still, and we're interested in feedback.
We've been developing the agent on GitHub for a while already, and I
know some of you folks have already been trying it out. If you haven't
yet, let us know how it goes when you get a chance.
Robin