[role="xpack"]

:modulename: zeek
:has-dashboards: true

== Zeek (Bro) Module

This is a module for https://zeek.org/[Zeek], which used to be called Bro. It
parses logs that are in the Zeek JSON format.

The Zeek SSL fileset will handle fields from these scripts if they are
installed in Zeek.

- https://github.com/salesforce/ja3/tree/master/zeek[JA3/JA3S Hashes]
- https://github.com/rocknsm/rock-scripts/blob/1abcb137c3c0cb7bc1d54248d738255d2d6eb4ba/protocols/ssl/ssl-add-cert-hash.zeek[SHA1 Certificate Hashes]

include::../include/gs-link.asciidoc[]

[float]
=== Compatibility

This module has been developed against Zeek 2.6.1, but is expected to work
with newer versions of Zeek.

Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD,
and Mac OS X.

[float]
=== Example dashboard

This module comes with a sample dashboard. For example:

[role="screenshot"]
image::./images/kibana-zeek.png[]

:has-dashboards!:

:modulename!:

