Zeek Newsletter - Issue 38 - April 2024

Welcome to the Zeek Newsletter.

In this Issue:

  • TL;DR
  • Development Updates
  • Zeek in the Community
  • Zeek in the Enterprise
  • Friends of Zeek
  • Upcoming Events
  • Zeek Package Updates
  • Get Involved


This is a light month in terms of news, but a lot is happening! ZeekWeek 2024 will be held on August 13th and 14th at the Caltech Ramo Auditorium 2 located in Pasadena, California. The CFP is open and tickets will go on sale soon. Additionally there will be a Zeek training event on August 15th. See later in the newsletter for details.

Development Updates

There was no code released in April, but you can expect patches in roughly the next week.

Zeek in the Community

On 1 May, Seth released a new version of Malcolm. Please see the project site for details:


Zeek in the Enterprise

Corelight is hiring a remote open source developer to work on Zeek. See this job description for details:


Friends of Zeek

On 23, the Suricata project released versions 7.0.5 and 6.0.19. Visit this site for details:


Upcoming Events

The next Zeek Community Call is 5 June at 1 pm ET. There is no need to register. Here is the Zoom link:


On 18 June Richard will present “Getting Started with Zeek” as a webinar. Register here:


ZeekWeek 2024 will be held on August 13th and 14th at the Caltech Ramo Auditorium 2 located in Pasadena, California. Additionally there will be a Zeek training event on August 15th. ZeekWeek will be an in-person event. Presentations will be recorded and published after the event. Stay tuned for registration details.

The call for papers for ZeekWeek 2024 is now live. Abstracts for talk submissions must be submitted by June 14th. Final notifications will be sent by July 1st. Talks will be reviewed in several rounds before the final submission deadline. Earlier submissions have a higher chance of acceptance. You will be notified as soon as a decision has been made on your talk.

Please see this post for details:


On 2 April, Seth posted to the Zeek Slack that DHS CISA will host a two day Malcolm-focused conference (MalCON) near Arlington, VA on 4-5 September. There will also likely be a virtual option. The event will likely include training for Malcolm, enterprise traffic analysis, and perhaps OT/ICS traffic analysis. If you would like to know more, contact Seth Grover in the Zeek Slack.

The next Security Onion conference will be held 4 October in Augusta, GA. The CFP is open. Please see this post for details:


Zeek Package Updates

Changes to packages are available via this search:


The https://packages.zeek.org site reported the last 5 updates as of 2 June:

5/3/24, 4:14 AM shodan-zeek

5/3/24, 12:09 AM zeekjs-redis

5/2/24, 8:32 PM zeek-ebury

5/2/24, 3:20 PM icsnpp-profinet-io-cm

5/2/24, 3:19 PM icsnpp-opcua-binary

Get Involved

If you have any comments or material for the newsletter please email news@zeek.org or join the #news Slack channel.


The Slack channel has been active during the past month. Here is an invitation link:


Stay up to date by joining the Zeek Discourse:


Subscribe to our YouTube channel:


Follow us on Twitter:


Follow us on Mastodon:


The old mailing list archives now redirect to this site:


If you’d like to read the Leadership Team meeting notes, they are here:


Follow us on LinkedIn:


To search LinkedIn for jobs mentioning Zeek skills, use this query:


See you next time!