Zeek Newsletter - Issue 65 - July 2026

Announcements
1

image
image690×362 47.6 KB

Welcome to the Zeek Newsletter

In this Issue:

TL;DR: Zeek 9.0 rc1 and 8.0.10 are targeting mid-August with extensive security and bug fixes. Lots of community news, including the 2026 Project Survey closing August 14, the Berkeley Workshop schedule launch, and a full redesign of zeek.org!

Community News & Reminders

  • Community Call Recap: This month we covered the upcoming Zeek 9.0 rc1, Leadership Team elections coming later this month, the zeek.org website redesign, and more. Watch the recording here. The next call is September 2 at 10am PT – use this Zoom link to join.

  • Berkeley Workshop: The schedule for the upcoming Zeek Workshop is officially live. Join us for two days of hands-on technical sessions, community talks, and deep dives into Zeek. Check out the full schedule and reserve your spot today.

  • The 2026 Project Survey: The annual community survey is open and runs through August 14. This year includes an optional focus group sign-up if you’re interested in providing feedback on future releases. Take the survey here.

  • Website Redesign: Our website recently got a full makeover! Take a look around at zeek.org and let us know on Slack if you find anything broken, missing, or looking weird.

  • Package Testing Blog Series: We recently published Yacin Nadji’s three-part series, The Cure for Exceptional Zeek Package Testing. It walks through practical techniques for testing packages when you lack a shareable PCAP, need to mock external APIs, or want to run tests on historical logs. Read Part 1 here.

  • Topic of the Month: Last week we wrapped up “Learning from Mistakes”, you can find the recap from the conversation here. This month’s topic is “Deployment Decisions” – join us on Slack to discuss!

  • Security Onion Conference: Our friends at Security Onion invite you to the Security Onion Conference, a great opportunity to connect with fellow defenders, learn best practices, and dive into the latest in network security monitoring and threat hunting. Tickets will be available later today!

Development Updates

Zeek 9.0 rc1 is targeting mid-August, with a full release expected around the beginning of September. The release is relatively light on new features but carries a large number of bug fixes (similar in volume to the recent 8.0.9 and 8.2.1 patch releases) driven by LLM security scanning and continued fuzzing work on the codebase.

Alongside 9.0, an 8.0.10 patch release will ship carrying the same fixes for users still on the LTS line. The 8.0 line will reach end of life when 9.1 ships at the end of the year.

As always, follow development progress on GitHub to stay current with the latest changes.

:light_bulb: Zeek Techniques

This month’s tip came from an anonymous submission:

When wrangling JSON logs where the ts field is a Unix timestamp (1783418081.078779), the following jq magic can be useful to add a human-readable ts_str field.

$ echo '{"ts": 1783418081.078779}' | jq '.ts_str=(.ts|strftime("%Y-%m-%dT%H:%M:%S"))'
{
  "ts": 1783418081.078779,
  "ts_str": "2026-07-07T09:54:41"
}

$ zcat 2026-07-0\*/weird\*gz | jq '.ts_str=(.ts|strftime("%Y-%m-%dT%H:%M:%S"))'
{
  "ts": 1783418081.078779,
  "uid": "CQpaRLaf2RsMEt40d",
   ...
  "ts_str": "2026-07-07T09:54:41"
}

For TSV logs, zeek-cut has the -d flag!

Share your tricks, shortcuts, or techniques with us using this form.

Packages

Anyone in the community can write add-on functionality for Zeek via packages.

Recently added or updated packages are always visible on GitHub directly, via the following search of pull requests to our package repository:

https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed

Recent Updates:

Get Involved

Thanks for being part of the community. We’ll see you next time!