# Introducing Zeek 5.2 **URL:** \ **Category:** Announcements\ **Tags:** blog\ **Created:** [March 6, 2023, 10:55pm UTC](https://community.zeek.org/t/introducing-zeek-5-2/6932 "2023-03-06T22:55:37Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [March 6, 2023, 10:55pm UTC](https://community.zeek.org/t/introducing-zeek-5-2/6932/1 "2023-03-06T22:55:37Z")
The Zeek team is proud to announce the release of [Zeek 5.2](https://github.com/zeek/zeek/releases/tag/v5.2.0), starting the final line of feature releases in the 5.x cycle. Development on 5.2 began in late September 2022 and has included some 660 commits, 178 PRs, and external contributions from the teams at Microsoft and Fox-IT, as well as from Fupeng Zhao, Jason Lu, Josh Soref, Nadav Kluger, and @jeff-bb on GitHub — thank you! The clear biggie for 5.2 is our emerging support for the Windows platform, thanks to Microsoft [open-sourcing their Zeek support](https://github.com/zeek/zeek/pull/2518) and their energetic collaboration to get the work merged — again, thank you! We have started to receive inquiries from users about the status of this work, so here is a summary: please consider Windows support experimental and partial at this time. Zeek’s basic functionality — traffic processing and log production — is functional, and we’ve updated [btest](https://github.com/zeek/btest), our test driver, to [support Windows](https://github.com/zeek/btest/actions/runs/4069551469) so a subset of Zeek’s testsuite now passes. Several pieces remain missing, such as support for Spicy, binary plugins, and Zeek packages. If you’re interested in Windows support, we’d very much like to hear from you. Your input and use cases will help us prioritize next steps in this effort. Given that AF\_PACKET has become the default packet capture solution on Linux, we’re now shipping with out-of-the-box AF\_PACKET support on Linux. To this end, we’ve expanded use of our ability to build external plugins into the distribution, and have moved Jan Grashöfer’s popular [Zeek package](https://github.com/zeek/zeek-af_packet-plugin) into the Zeek project space. The package remains available for users of older Zeek versions, just as before. Zeek’s analyzer framework has gained significant flexibility, with more helpful `analyzer_confirmation_info` and `analyzer_violation_info` events, improved violation support for analyzers, and new `Analyzer::enable_analyzer()` and `Analyzer::disable_analyzer()` primitives for packet analyzers. Run-time event-handler management returns! The new `&group` attribute allows tagging of individual event handlers into groups, with corresponding `disable_event_group()` and `enable_event_group()` functions to disable/enable them. [Module-level control](https://docs.zeek.org/en/master/scripting/event-groups.html#module-based-event-group) is provided by the `disable_module_events()` and `enable_module_events()` functions. We’ve also upgraded our Docker image build pipeline for this release. For performance reasons we’ve moved the builds from GitHub to Cirrus CI, and now publish multi-platform images that support both amd64 and arm64 architectures, enabling the use of our official images on Apple’s M family of processors. We’re in the process of switching the DockerHub organization from `zeekurity` to `zeek`, with both receiving image pushes at the moment. If you’re using our Docker images, please pull from the `zeek` organization (e.g. `docker pull zeek/zeek:latest`) as we’ll sunset the `zeekurity` account in the near future. We’ve upgraded several components of Zeek as well: - [Spicy](https://github.com/zeek/spicy) has moved to version [1.7](https://github.com/zeek/spicy/releases/tag/v1.7.0) thanks to the Spicy team’s work, with efforts currently underway to improve build and runtime performance, and to start migrating the first Zeek-included parsers to it. Highlights of the 1.7 release include [DPD-style protocol detection](https://docs.zeek.org/projects/spicy/en/latest/zeek.html?highlight=accept_input#dynamic-protocol-detection-dpd), as well as support for arbitrary expressions as arguments to type constructors. - [zeekctl](https://github.com/zeek/zeekctl) now assigns network ports to workers starting at port 27760, fixing an issue where workers were starting up with ports within Linux’s ephemeral port range. - [zeek-client](https://github.com/zeek/zeek-client), the Management Framework’s new management CLI, is now at version 1.2.0, with a significant functional upgrade: it now uses Broker’s WebSocket data transport, removing a hard dependency on Broker itself. As a result, users can now install the client from PyPI with a quick `pip install zeek-client`. These are just some of the highlights of this release. Please consult the [release notes](https://github.com/zeek/zeek/releases/tag/v5.2.0) for a complete overview, and the [documentation](https://docs.zeek.org/en/v5.2.0/) for details. With 5.2 out the door, we’ve begun to focus on our next LTS line of releases — 6.0.x — to land in the summer. As usual, our “mid-cycle” 5.1.x releases will see no further additions at this point, with 5.0.x LTS releases continuing as required until Zeek 6 comes out. Feedback and questions are always welcome, so please feel free to get in touch via our [community channels](https://zeek.org/community/).