Zeek 9.0.0-rc2 is now available:
https://download.zeek.org/zeek-9.0.0-rc2.tar.gz
We are now targeting September 14 for the full release. Binary packages will be available here.
If you missed it, Christian’s development update post covers what’s new and changing in 9.0.
Changes since 9.0.0-rc1:
-
A number of fixes to the tarball and configure script that were broken in 9.0.0-rc1. Tarball builds should function correctly, as well as builds on air-gapped systems.
-
Broker’s IdentifierUpdate messages are now disabled by default. IdentifierUpdate clashed with the config framework in a number of ways. See the NEWS for more information about this change entails.
A few things to check depending on your setup:
-
Broker-based Websocket server removed The old Broker-based Websocket server has been removed, replaced with a Zeek-native solution. See the NEWS for more information about what this change entails.
-
New UDP packet source The
zeek-packet-source-udpplugin is now included by default in Zeek. This packet source can be used to read data directly from VXLAN and GENEVE mirrors directly, useful in cloud environments. -
Multi-host Systemd generator The systemd configuration generator added in Zeek 8.1 has been extended to support multiple interfaces as well as support for multi-host deployments.
Compared to Zeek 8.2, this release features two new NTP logs, ntp_control.log and ntp_private.log. There are no other structural changes to Zeek’s default log schema. kerberos.log now also reports AP-REQ (Application Request) tickets.
Will any of this affect your setup?
Reply to this post or share your feedback in #general on Slack. We want to hear from you before the final release ships on September 14.
As a reminder, 9.0.0 will mark the end of 8.2 support. The 8.0.x LTS line continues getting patch releases as normal until 9.1.0 is released.