# Zeek Newsletter - Issue 52 - June 2025 **URL:** \ **Category:** Announcements\ **Tags:** newsletter\ **Created:** [July 3, 2025, 4:47pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823 "2025-07-03T16:47:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![michelle](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/michelle/32/772_2.png) [@michelle](https://community.zeek.org/u/michelle)\ **Post date:** [July 3, 2025, 4:47pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823/1 "2025-07-03T16:47:49Z")
![Zeek Monthly Newsletter](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/2d4c65e2b4ebf8b0428ad3c8e15ab899b1069208.jpeg) # Welcome to the Zeek Newsletter **In this Issue:** - [Reminders](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-dont-miss-this-reminders-for-the-community-3) - [Zeek Tip of the Month: `getenv` Function](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-zeek-tip-of-the-month-4) - [Community Call Recap](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-community-call-recap-5) - [Development Updates](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-development-updates-6) - [Ecosystem News](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-ecosystem-news-11) - [Package Updates](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-zeek-package-updates-15) - [Get Involved](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823#p-29412-get-involved-16) * * * ## **[TL;DR]** Zeek 8 development is charging ahead with pluggable connection keys, improved cluster metrics, and IPv6 support for ZeroMQ. The Zeek Project Survey 2025 is live! Please fill it out and share it with other users. Plus, catch up on fresh ecosystem news from Security Onion and Malcolm, and don’t forget to check out our Zeek Tip of the Month 🙂 * * * ## **Don’t Miss This – Reminders for the Community** We have a lot of ideas for how to improve Zeek, but we want to hear from you: - **Zeek Project Survey 2025** : Tell us about your experience, needs, and ideas so we can keep making Zeek better. [Take the survey and share it with other Zeek users!](https://zeek.org/survey) The survey closes July 17. - **Slack Workspace Feedback** : We’ve recently reorganized Slack to be easier to navigate. Have thoughts on channels, norms, or ways to help everyone get more value out of it? [Join and tell us!](https://join.slack.com/t/zeekorg/shared_invite/zt-373j1iyaf-t7Ss2wrGviDqBRVBf0Y43Q) It’ll help us prioritize the right features, improve documentation, and build a better Zeek community. * * * ## **💡 Zeek Tip of the Month:** Zeek scripts can access system environment variables using the `getenv` function. This is especially useful when running Zeek in Docker or other containerized environments, where configuration is commonly supplied through environment variables. [Check out the documentation to learn more. ](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-getenv) Have a tip of your own? We’re looking for tricks, shortcuts, or helpful techniques to feature in the newsletter. Let us know how you’re using Zeek – your tip might help someone else in the community. Submit yours [here](https://forms.gle/1DR2ei98E1n54dg39). * * * ## **Community Call Recap** This month, we shared recent LT meeting discussions, a brief status update on Zeek 8.0 development, and early insights from the [Zeek Project Survey 2025](https://zeek.org/survey) (closes July 17). We also want to remind the community that the next Zeek training will be held at the [2025 NSF Cybersecurity Summit](https://www.trustedci.org/2025-nsf-cybersecurity-summit) in Boulder, CO (October 20-23). If you couldn’t join the meeting live, the recording is available on our [YouTube channel](https://youtu.be/WvTXmYBXS5M). 📅 The next call is August 6 at 10am PT (1pm ET). [Use this Zoom link to join.](https://us06web.zoom.us/j/99882457331?pwd=WVZLRGtpbmx1V2FqSnlRT1FLRC9lQT09) There’s no registration required, just drop in and join the conversation. See you there! * * * ## **Development Updates** Work continues on Zeek 8, with several important improvements landing or in progress: ### Pluggable Connection Keys The[first pluggable connection keys PR](https://github.com/zeek/zeek/pull/4579) has landed. Zeek has long used the classic 5-tuple as connection keys. Now, you can write Zeek plugins to customize this behavior—enabling support for VLAN IDs or VXLAN/Geneve VNIs in connection keys. This is a big win for deployments monitoring overlapping IP ranges. VLAN-scoped 5-tuple support is already included and can be enabled via `@load zeek frameworks/conn_key/vlan_fivetuple` We’re still iterating on this feature, but if this piques your interest, check out the [current version of the connkey plugin tutorial](https://docs.zeek.org/en/master/devel/plugins/connkey-plugin.html). ### Detailed Cluster Metrics Zeek now provides more detailed cluster metrics via Prometheus or `telemetry.log`. By default, it reports the number of incoming and outgoing cluster events per node. You can enable verbose and debug metrics by redefining `Cluster::Telemetry::core_metrics`, allowing you to monitor events broken down by topic and handler name, and analyze serialized event sizes using Prometheus-style histograms. WebSocket clients connected to Zeek are tracked separately. If a client includes an `X-Application-Name` HTTP header, its metrics will be tagged with an `app` label based on that value. Note: the [`endpoint` label has been renamed to `node`](https://github.com/zeek/zeek/pull/4552). If you use Zeek metrics with Grafana, you may need to update your dashboards accordingly. Check out the [`telemetry.zeek` script](https://github.com/zeek/zeek/blob/master/scripts/base/frameworks/cluster/telemetry.zeek) in the cluster module for more details. ### IPv6 Support for ZeroMQ Cluster Backend The ZeroMQ cluster backend [now supports IPv6](https://github.com/zeek/zeek/pull/4590), expanding deployment options in dual-stack environments. ### Analyzer Updates The FTP analyzer [gained explicit AUTH TLS](https://github.com/zeek/zeek/pull/4503) support, the DNS analyzer now [parses NAPTR responses](https://github.com/zeek/zeek/pull/4595) and reporting of BDAT commands in[smtp.log was fixed](https://github.com/zeek/zeek/pull/4526). * * * ## Ecosystem News ### Security Onion 2.4.160 Released The latest Security Onion release includes Playbooks, Guided Analysis, MCP Server, and more. A highlight for Zeek users: the new Guided Analysis tab helps analysts investigate alerts step by step, leveraging Playbooks with built-in queries – many of which automatically correlate Zeek data with other sources. [Read the full release announcement here.](https://blog.securityonion.net/2025/06/security-onion-24160-now-available.html) ### Malcolm v25.06.0 Now Available Malcolm’s latest release adds role-based access control (RBAC), bug fixes, and numerous improvements across components. Notable for Zeek users: support for Zeek 7.2.1, extended intel.log fields via corelight/ExtendIntel integration, and configuration tweaks for easier Kafka plugin use. Malcolm remains an easy-to-deploy suite for network traffic analysis that heavily leverages Zeek logs. [See the full release notes here.](https://github.com/idaholab/Malcolm/releases/tag/v25.06.0) ### Zeek at FIRST 2025 Aashish Sharma (Zeek Leadership Team, Lawrence Berkeley National Lab CSIRT) recently gave a lightning talk on Zeek at [FIRST 2025](https://www.first.org/conference/2025/) in Copenhagen, with a great turnout to discuss all things network monitoring and intrusion detection. ![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf5ckXJaED56R5qVV6UZTSA4__AO3y5q4wz9Ly96y1vdvI8arzQB5RSQDMY0ciLS7KSzfiKUKyA7kf7WHy9iWpy2MUyEkJJcf-3dRi3iS0vZ_UIDj1tc_2uxgNLvKaMkIYeEKZA?key=P_nEZY7YLA0OPVd8K7Ra1Q) * * * ## Zeek Package Updates Anyone in the Zeek community can write add-on functionality for Zeek via packages — see [https://packages.zeek.org](https://packages.zeek.org) to browse them, and our [zkg package manager documentation](https://docs.zeek.org/projects/package-manager/en/stable/index.html) to get started. Don’t forget to check out [#package-sharing](https://zeekorg.slack.com/archives/CTGDGK6EA) on Slack to see what packages others are working on, or share your own. Recently added or updated packages are always visible on GitHub directly, via the following search of pull requests to our package repository: [https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed](https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed) Latest updates: > ### pre-commit-hooks > > Some out-of-the-box hooks for pre-commit. > > [https://github.com/pre-commit/pre-commit-hooks](https://github.com/pre-commit/pre-commit-hooks) > ### Unauthorized SMB Usage - Zeek Package > > This Zeek package detects SMB/SMB2 connections to unauthorized IP addresses based on a configurable whitelist. > > [https://github.com/Cynthianfatkid/zeek-unauthorized-smb-usage](https://github.com/Cynthianfatkid/zeek-unauthorized-smb-usage) > ### ICSNPP-C12.22 > > A plugin (written in [Spicy](https://docs.zeek.org/projects/spicy/en/latest/)) for parsing and logging fields used by the ANSI C12.22 protocol as presented in IEEE standard 1703-2012, defining a transmission format for utility end device data tables or control elements. > > [https://github.com/cisagov/icsnpp-c1222](https://github.com/cisagov/icsnpp-c1222) * * * ## Get Involved Got ideas, feedback, or content for the newsletter? Send us a note at [news@zeek.org](mailto:news@zeek.org) or drop by the [#security-news](https://zeekorg.slack.com/archives/CT0J1PSR2) channel on Slack. [Join Slack here](https://join.slack.com/t/zeekorg/shared_invite/zt-12z1pjy93-zuVGuT1BF~yUJJvERxhp7g). Stay in the loop and connect with others in the Zeek community: - See what people are talking about on [Discourse](https://community.zeek.org) - Subscribe to our[YouTube channel](https://youtube.com/c/Zeekurity) - Follow us on[Mastodon](https://infosec.exchange/@zeek), [Bluesky](https://bsky.app/profile/zeek.org), and[LinkedIn](https://www.linkedin.com/company/zeekurity) Want more insider updates? Check out the[Leadership Team meeting notes](https://community.zeek.org/c/lt-meeting-notes/13). And if you’re hunting for Zeek-related jobs, here’s a handy[LinkedIn search](https://www.linkedin.com/jobs/search/?keywords=zeek). _ **Thanks for being part of the community. We’ll see you next time!** _ ---
**Author:** ![michelle](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/michelle/32/772_2.png) [@michelle](https://community.zeek.org/u/michelle)\ **Post date:** [July 3, 2025, 5:11pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823/2 "2025-07-03T17:11:54Z")
---
**Author:** ![michelle](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/michelle/32/772_2.png) [@michelle](https://community.zeek.org/u/michelle)\ **Post date:** [August 7, 2025, 5:31pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-52-june-2025/7823/3 "2025-08-07T17:31:16Z")