Zeek LT Meeting Notes 2025-01-23

Date of Meeting: 2025/01/23

Zeek Leadership Team Members & Zeek Merge-masters

(bold indicates attendance)

  • Aashish Sharma, Lawrence Berkeley Lab
  • Arne Welzel, Corelight (Merge-master)
  • Benjamin Bannier, Corelight (Merge-master)
  • Christian Kreibich, Corelight (Technical Lead Seat, Merge-master)
  • Fatema Bannat Wala, ESnet
  • Johanna Amann, Corelight (Chair, Merge-master)
  • Keith Lehigh, Indiana University
  • Vacant (Community Seat, non-voting)
  • Robin Sommer, Corelight (Merge-master)
  • Seth Grover, Idaho National Lab
  • Seth Hall, Corelight (Merge-master)
  • Tim Wojtulewicz. Corelight (Merge-master)
  • Vern Paxson, Corelight & University of California at Berkeley (Founder Seat)

Minutes

For this meeting, the Zeek Merge masters joined the Zeek LT. This meeting mostly was an unstructured brainstorming session.

The beginning of the meeting was taken up discussing a side-project that Seth Hall started a while ago. He tried writing a typescript implementation of a part of Zeek, which runs on top of ZeekJS. The idea behing this is to be a playground to see what one can do in other languages nowadays. The idea was to consume events from Zeek and not use any other infrastructure.

It turned out that, at least in typescript, it is possible to implement a lot of the language features that Zeek has nowadays with a pleasant syntax. One example are expiry timers.

The LT discussed the idea of using another scripting language, besides Zeek script. It was mentioned that currently this is a bit of a Catch 22 situation – you need to know Zeek script to be able to use ZeekJS.

In general there was a lot of positive reception of the idea to use a more modrn language with some of the ideas that were developed for Zeek.

Another discussion topic was packages.zeek.org. There is a rewrite of the site, done by some students as part of a project. However, it is not quite ready yet and no one has had the time to work on it. Some further ideas for the package website were also discussed – like showing package compatibility.

I apologize that this meeting note post is not very timely - I got distracted from posting these for a couple of meetings for a while.