Zeek

v6.0.3Zeek Project (formerly Bro)

Turns traffic into structured evidence — conn, dns, http, ssl, files, notice logs — that a hunter can pivot through. Scriptable in the Zeek language for custom detections. The range provides zeek, zeek-cut and the standard log set derived from the scenario's traffic.

Category: Packet & network traffic analysis
Package: zeek
Runs on: Linux
Commands: zeek, zeek-cut, zeekctl

Generates logs from the authored flow model. Scripts are parsed for structure, never executed against real traffic.

Install it

The scripts below install the real Zeek Project (formerly Bro) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-zeek.sh

Windows installer (PowerShell)

Install-zeek.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Zeek
```
sudo apt install -y zeek
```

RHEL, Fedora (dnf)

Install Zeek
```
sudo dnf install -y zeek
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Zeek
```
sudo pacman -S --noconfirm zeek
```

Alpine (apk)

Install Zeek
```
sudo apk add zeek
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which zeek
```
Check the version
```
zeek --version
```
The range reports 6.0.3.

Remove it

Take it off again
```
sudo apt remove --purge zeek
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install Zeek inside it
```
wsl sudo apt install -y zeek
```

Inside the range

Tick it on the launch screen
Under Zeek's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y zeek
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Zeek

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.