Zeek

Free · OSS

Network & IDS

Turns raw traffic into the searchable record of exactly what happened.

Turns raw network traffic into searchable structured logs — every DNS query, every TLS handshake, every HTTP request. Where Suricata says "this looks bad," Zeek lets you reconstruct exactly what happened.

CyberCLI pack v1.0.0 beta

updated 2026-06-06

Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.

What it watches

Connection logs — every flow, who talked to whom, for how long
DNS, HTTP, TLS, SSH, SMB transaction logs
File transfers + extracted-file hashes
Long-lived / beaconing connections
Certificate + JA3 anomalies

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0007 · Discovery TA0008 · Lateral Movement TA0010 · Exfiltration TA0011 · Command & Control

See the full coverage matrix →

Every alert this connector surfaces

4 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type	dashboard renders
connection	Network connection on zeek
dns	DNS activity on zeek
notice	IDS notice on zeek
zeek_other	Zeek activity on zeek

What it helps you catch

When Suricata says 'this looks bad,' Zeek lets you reconstruct the whole session — the forensic timeline of the intrusion.

Catches low-and-slow beaconing by the rhythm of the connection log, not a signature.

Surfaces data staging + exfil by the size and direction of flows to an external host.

What you'd see in CyberCLI

illustrative

CYCON 3 high

Zeek

When Suricata says 'this looks bad,' Zeek lets you reconstruct the whole session — the forensic timeline of the intrusion.

Routed to Warden (triage) → Knight (detection) → Scribe (record)

⛓ every step hash-chained · replayable

What CyberCLI reads from Zeek

audit our math

Fields normalized

parsed from the source event

Event categories

—

with on-disk fixtures

Trust Ladder

L0 → L3

AI authorization range

Zeek doesn't ship signatures — it ships analysis. The 39 fields we read carry the network story across log types: the connection 4-tuple (src_ip/dst_ip/ports/proto) plus Zeek's uid for cross-log correlation, conn.log forensic detail (service, conn_state, history, orig/resp bytes, duration), dns.log query family (query_name, qtype, rcode_name, answers), and the notice.log analyst layer (note, msg, sub, peer_descr, fully-qualified actions) with a derived vendor_remediation_action so the operator reads drop/notify/log without parsing Zeek enums.

Full field index · 39 fields ↓

.action.answers.conn_history.conn_state.cybercli_class.cybercli_external_id.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.dst_alt.dst_ip.dst_port.duration_sec.event_id.event_timestamp.event_type.local_orig.local_resp.message_text.note.notice_actions.orig_bytes.peer_descr.proto.query_class.query_name.query_type.rcode_name.resp_bytes.rule_id.rule_level.src_alt.src_ip.src_port.sub.uid.vendor_remediation_action.zeek_log.zeek_service

MITRE techniques typically mapped

T1046 ↗
Network Service Discovery

Discovery
T1071.004 ↗
Application Layer Protocol: DNS

Command and Control
T1568.002 ↗
Dynamic Resolution: Domain Generation Algorithms

Command and Control
T1021 ↗
Remote Services

Lateral Movement
T1572 ↗
Protocol Tunneling

Command and Control
T1048 ↗
Exfiltration Over Alternative Protocol

Exfiltration

Trust Ladder ceiling · L0 → L3

AI can authorize

·L0–L2: digest notice.log alerts, notify on high-signal notes, summarize conn/dns/http context around the case
·L3 (Knight verification): reputation lookup on dst_ip/query_name, JA3/SNI pivoting through paired ssl.log, cross-reference the Zeek uid against Suricata flows and EDR telemetry — read-only

Requires human approval

·L4+: containment — Zeek is analysis-only in this stack; blocks route through firewall/EDR/UniFi connectors that own the enforcement plane

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/zeek/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.