Zeek Newsletter - Issue 54 - August 2025

Announcements
1

image
image690×362 58.7 KB

Welcome to the Zeek Newsletter.

In this Issue:

[TL;DR]

Zeek 8 is out! The Zeek Leadership Team election cycle has begun and nominations are open through September 12. All active community members are strongly encouraged to run. We’re looking for a volunteer to lead a Zeek training session at the upcoming NSF Cybersecurity Summit on October 20 in Boulder, Colorado. Other in-person opportunities include hack.lu in Luxembourg and the Zeek Workshop Europe 2026 at CERN.

This issue also features highlights from this month’s Community Call, plus new tips, blogs, and videos to help you get the most from Zeek.

Don’t Miss This – Reminders for the Community

Zeek Leadership Team Election

Nominations are now open for four seats on the Zeek Leadership Team. The LT guides project activities like event planning, outreach, and finances–technical expertise is not required. If you’re active in the Zeek community (forums, Slack, testing, talks, etc.), consider nominating yourself or someone you know.

Important dates:

  • Nominations close: September 12
  • Voting begins: October 2
  • New LT members take office: October 27

Submit nominations here: https://forms.gle/UFt2Sp72hMaGy95f8

For details on the election process and LT roles, visit our wiki.

Lead a Zeek Training at NSF Summit

We’re looking for a community volunteer to present a Zeek training session at the NSF Cybersecurity Summit on October 20 in Boulder, CO. Interested? Let us know in the #training channel on Slack.

For attendees, the agenda and registration are also now available.

Additional In-Person Zeek Opportunities

  • We’ll be at hack.lu in Luxembourg from October 21–24. Christian is going to give a talk on integrating Zeek with third-party applications. Come say hi!
  • We’re hosting a two-day community workshop at CERN in Geneva, Switzerland, on March 25–26, 2026. Stay tuned for agenda and registration details.

:light_bulb: Zeek Tip of the Month

Use the &ordered attribute on tables or sets when you want iteration to follow the order in which elements were inserted. This is especially handy when the order itself carries meaning. For example, Zeek uses &ordered on the services field to preserve the sequence in which services were detected for a connection.

Learn more in the Zeek documentation.

Have a tip of your own?

Share your tricks, shortcuts, or techniques with us! Your contribution might help others in the community. Submit your tips here.

Zeek Community Call Recap

This month, Vince Stoffer (Field CTO at Corelight) gave a community lightning talk on Zeek and Post-Quantum Cryptography Discovery (thanks Vince!). We look forward to featuring more community talks in future calls.

The team also covered Zeek 8.0 updates, the upcoming 8.1 release, the Leadership Team election, and NSF Summit training.

Missed it? Watch the recording on our YouTube channel.

:date: The next call is October 1 at 10am Pacific Time. Use this Zoom link to join. There’s no registration required, just drop in and join the conversation. See you there!

Development Updates

August Recap

Last month began with the first release candidate for Zeek 8, which held up very well in testing. The development team added one more release candidate to fix minor omissions, and released Zeek 8.0 on schedule on August 18.

The second half of the month kept the team busy with putting together release coverage, and a few follow-up features for the inevitable 8.0.1 on August 26 with minor bugfixes and tweaks. The team also used the post-release breather to revamp the CI posture to update platforms, streamline per-PR coverage, and establish weekly testing.

We’ve also inlined the AF_PACKET, binpac, bifcl, and gen-zam submodules into the main tree, which you may notice as you update your git clones. More of this will follow in the upcoming weeks.

More on Zeek 8

For a deeper look at some of the changes in the release, check out our latest blog posts and video tutorials:

More Zeek 8 content is coming soon :slightly_smiling_face:

Zeek Package Updates

Anyone in the community can write add-on functionality for Zeek via packages. Browse them here: https://packages.zeek.org or head to our zkg package manager documentation to get started. Check out #package-sharing on Slack to see what packages others are working on or share your own.

Recently added or updated packages are always visible on GitHub directly, via the following search of pull requests to our package repository:

https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed

Latest updates:

None this month, but the Zeek package ecosystem is always active! Check out the full list of packages on GitHub.

Get Involved

Got ideas, feedback, or content for the newsletter? Send us a note at news@zeek.org or drop by the #security-news channel on Slack. Join Slack here.

Stay in the loop and connect with others in the community:

Want more insider updates? Check out the Leadership Team meeting notes.

And if you’re hunting for Zeek-related jobs, here’s a handy LinkedIn search.

Thanks for being part of the community. We’ll see you next time!