Zeek LTS pre-release 9.0.0-rc1

Announcements
,
1

Zeek 9.0.0-rc1 is now available:

https://download.zeek.org/zeek-9.0.0-rc1.tar.gz

We are targeting September 8 for the full release. Binary packages will be available here.

If you missed it, Christian’s development update post covers what’s new and changing in 9.0.

A few things to check depending on your setup:

  • Broker-based Websocket server removed The old Broker-based Websocket server has been removed, replaced with a Zeek-native solution. See the NEWS for more information about what this change entails.

  • New UDP packet source The zeek-packet-source-udp plugin is now included by default in Zeek. This packet source can be used to read data directly from VXLAN and GENEVE mirrors directly, useful in cloud environments.

  • Multi-host Systemd generator The systemd configuration generator added in Zeek 8.1 has been extended to support multiple interfaces as well as support for multi-host deployments.

Compared to Zeek 8.2, this release features two new NTP logs, ntp_control.log and ntp_private.log. There are no other structural changes to Zeek’s default log schema. kerberos.log now also reports AP-REQ (Application Request) tickets.

Will any of this affect your setup?

Reply to this post or share your feedback in #general on Slack. We want to hear from you before the final release ships on September 8.

As a reminder, 9.0.0 will mark the end of 8.2 support. The 8.0.x LTS line continues getting patch releases as normal until 9.1.0 is released.