Announcing the Zeek Agent
Summary: Trail of Bits and Corelight released the Zeek Agent, an open-source BSD-licensed tool that feeds endpoint events such as new processes, opened sockets, and user logins into Zeek's standard processing pipeline alongside network-derived events. The agent began as Steffen Haas's 2018 zeek-osquery prototype at the University of Hamburg, was rewritten by Trail of Bits in 2019 as a standalone osquery extension, and ships now for macOS and Linux with Windows support in progress.
What's compelling: Passive network monitoring cannot assess the content of encrypted traffic, so defenders stay blind to whether a connection is legitimate; the Zeek Agent adds the endpoint vantage point that tells them which process and user account opened it.
Read the original at Trail of Bits Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026