Welcome to the Zeek Newsletter
In this Issue:
TL;DR: Zeek 9 RC2 is out and the team needs your testing feedback before release in about two weeks. Berkeley Workshop registration closes soon (last call!), and we’ve refreshed the #jobs and #security-news Slack channels.
Community News & Reminders
-
Community Call Recap: This month we covered Zeek 9 RC2, plus three Zeek 9 preview lightning talks. Watch the recording here. The next call is October 7 at 10am PT – use this Zoom link to join.
-
Berkeley Workshop: Last call for registration! Save your seat and check out the schedule for our upcoming workshop, September 10-11 in Berkeley, CA.
-
The 2026 Project Survey: Thanks to everyone who took the survey. The team is looking forward to putting the feedback into action. Michelle wrote a short blog post that covers some of the results and initial findings.
-
New Blogs: Check out Aashish’s recently published “How Attackers Learn Your Network Before They Attack It” and Arne’s “Beyond ZeekControl”.
-
Slack Channel Revival: We’ve refreshed the #jobs and #security-news channels as dedicated spaces for relevant industry headlines, open positions, and job seekers. Drop by to skim recent news, post a role, or share that you’re open to work!
-
Topic of the Month: On Monday we wrapped up “Deployment Decisions”, you can find the recap from the conversation here. This month’s topic will be shared next week – join us on Slack to get the first look!
Development Updates
Zeek 9 RC2 is out now and we’re looking for volunteers who can test it and send feedback. The release window is just under two weeks from now, assuming feedback stays clean, and testing from the community is the most valuable thing you can do right now to help get us there.
The team has also been working through a significant volume of security issues produced by recent collaborations, including work with Trail of Bits, Anthropic, the Canadian Communications Security Establishment, and our internal analysis. As a consequence the team has made some changes to our security issue process: we have expanded the turnaround time for high-severity issues from 4 to 12 weeks, and we have started to publish Security Advisories on Github to enable better referencing of issues. Progress is steady but the team is smaller than the workload, so RC2 testing and feedback from the community is especially appreciated.
As always, follow development progress on GitHub to stay current with the latest changes.
Zeek Techniques
This month’s tip came from a conversation in our development channel on Slack:
If a table or set is quietly growing unbounded somewhere in your scripts (or a node’s memory is climbing for no obvious reason), global_container_footprints() is worth knowing about. It’s a built-in function that generates a table of the “footprint” of every global container variable (table, set, etc.), giving you an approximate object count for each. The number isn’t meant to be precise, but it’s comparable: a larger footprint means more memory consumption, so you can spot the culprit without guessing.
The community example: a proxy node ballooning to hundreds of GB turned out to be a runaway table nobody was watching closely. Pairing global_container_footprints() with zeekctl print <var> <node>, which lets you inspect a specific variable’s value on a live node remotely, is what surfaced it.
Share your tricks, shortcuts, or techniques with us using this form.
Ecosystem News
-
Arkimeet 2026 is happening October 6 in Herndon, VA: A free day of talks, roadmap discussion, and networking with the Arkime community. Zeek and Arkime users overlap heavily, so worth a look if you’re nearby. Registration required by September 22. Details here.
-
Malcolm v26.08.0 is out, one of the biggest releases in a while! It includes Zeek v8.2.2 along with a long list of other updates. Full release notes here.
-
Security Onion Conference 2026 is coming up October 23 in Augusta, GA: The twelfth annual event features talks from the Security Onion community, plus training the week prior. Details and registration here.
Packages
Anyone in the community can write add-on functionality for Zeek via packages.
- Browse Zeek packages: https://packages.zeek.org
- Head to our zkg package manager documentation to get started on your own
- Questions? Check out #package-sharing to get help
Recently added or updated packages are always visible on GitHub directly, via the following search of pull requests to our package repository:
https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed
Recent Updates:
Get Involved
- Share ideas or content: news@zeek.org or #security-news on Slack.
- Stay connected: Discourse • YouTube • Mastodon • Bluesky • LinkedIn
- Check out Leadership Team meeting notes for insider updates.
- Looking for Zeek jobs? See openings on LinkedIn.
Thanks for being part of the community. We’ll see you next time!